diff --git a/OVERVIEW.md b/OVERVIEW.md index d3cfa91..7286a47 100644 --- a/OVERVIEW.md +++ b/OVERVIEW.md @@ -12,10 +12,11 @@ limit: a chat message, a ticket or a timer take the same path on the same code ([two deployment shapes](docs/deployments.md)). The alert deployment ran in production until 2026-09-23. -Every screenshot is from a local run started from nothing on 2026-09-30, not a -mockup. The investigator's pictures come from five real investigations on -`gpt-5.6-luna` ($1.10 together, through a gateway speaking the Anthropic -dialect). The rest come from the no-key demo and the stack smoke. +Every screenshot is from a local run started from nothing, not a mockup. The +investigator's pictures come from five real investigations on `glm-5.3` on +2026-11-12 ($0.44 together at Z.ai's list rates, through Zhipu's endpoint that +speaks the Anthropic dialect). The rest come from the no-key demo and the stack +smoke on 2026-09-30, and the phones from the demo on 2026-11-12. ``` upstream alert sources (Grafana / Alertmanager / cloud monitoring …) @@ -107,30 +108,38 @@ startup; a node wider than it declared refuses to start. The one node meant to change things runs `danger-only`, where the credential is the blast radius and nothing arrives without a person's signed click. -![hookprobe's sessions tab: five real investigations on the left, the payment-gateway report on the right, conclusion first, root cause unknown and said so](docs/img/hookprobe-sessions.png) - -The console lists sessions on the left and the conversation on the right, with -each turn's bill (gpt-5.6-luna · in 1.5k · out 1.4k · cache 55.6kr/21kw · -$0.2137 · 25.1s). The report opens on its conclusion and says what it could -not establish: the host is fictional and unreachable, so the root cause is -**Unknown**, and the possible causes are named as inferences, not findings. It -searched the case files first, ranked the remediation, and refused to propose -a command it could not justify. Below it: the two rulings a person can press, +![hookprobe's sessions tab: five real investigations on the left, the payment-gateway report on the right, its conclusion first and what it observed set apart from what it inferred](docs/img/hookprobe-sessions.png) + +The console lists sessions on the left and the conversation on the right, +each turn with its bill under the report (glm-5.3 · in 24.3k · out 11.2k · +cache 52kr/0w · $0.0968 · 209.2s). The report opens on its conclusion and says +what it could not establish: nothing in the container reaches production, so +it reads gateway-2's 5xx as one symptom of a fleet-wide failure from the +alerts' timing alone — gw-3 and gw-4 fired the same rule within seconds — and +names db-1's filling disk as the leading shared cause, an inference and +labelled as one. It opened the sibling case files first, set what it observed +apart from what it inferred, and ranked the remediation; the three commands it +proposes, two read-only checks and one that deletes old logs, wait in +Approvals for a person. Below the report: the two rulings a person can press, and the button that distills the run into a runbook draft. A follow-up in the box at the bottom resumes the same session with everything it gathered. ![audit view: every tool call in every run, subagents included, newest first](docs/img/hookprobe-audit.png) The audit view is a flight recorder the agent cannot edit: one line per tool -call across all runs. Here, 23 calls: the five runs reading each other's case -files and grepping for their alerts' terms. +call across all runs. Here, 52 calls: the five runs reading each other's case +files, grepping the audit log for their hosts and asking DNS for the hosts, +and the hourly selftest's four calls, refused as they should be. The disk run's +one refusal is further down: an `ssh -G db-1` the read-only guard stopped +before it ran. ![the waterfall: model and tool calls of one investigation on one time axis](docs/img/hookprobe-waterfall.png) The CLI reports every model call and tool result to the service itself, and -the run's page draws them on one axis. This run took 25 seconds, all of it -waiting on the model across five rounds; its two costliest calls were 72% of -its $0.21. +the run's page draws them on one axis. This run took 209 seconds, all of it +waiting on the model across six rounds; the last call alone spent 165 seconds +writing the 9.6k-token report, and the two costliest calls were 72% of its +$0.10. ![skills browser: the diagnostic runbook distilled from the disk investigation, its six lookups and what they found](docs/img/hookprobe-skills.png) @@ -145,8 +154,11 @@ unzipping it into `.claude/skills/`. The environment memory (CLAUDE.md) reaches every investigation. The demo's says the alerts' hosts are fictional and unreachable and that a reading nobody took must never be reported, and the report above is that memory arriving at the -model: "the host is fictional/inaccessible", "Root cause: Unknown". The prompt -view beside it holds the methodology; both are read fresh at every run. +model: "no reading was taken on any of those systems", "No reading is reported +below that nobody took." What the runs suggest adding waits above it for a +person; a plain fact about this deployment, like the one about top-ups, is +applied by itself under a heading that says so. The prompt view beside it holds +the methodology; both are read fresh at every run. Four more things fill it out: diff --git a/README.md b/README.md index 19140ed..c05fc3a 100644 --- a/README.md +++ b/README.md @@ -36,6 +36,8 @@ The investigator is the product. The pipe and the judge are the smallest alertin - **Half a day, for real:** [STACK.md](STACK.md) runs all three from source; [docs/containment.md](docs/containment.md) is the boundary map you read *before* pointing it at a cluster. - **What it does, in full:** [docs/what-you-get.md](docs/what-you-get.md). +![hookprobe's console: a real investigation on GLM-5.3, its conclusion first, what it observed set apart from what it could only infer, and its cost in the header](docs/img/hookprobe-sessions.png) + ![the three boards on a phone, each laid out as an app with a frosted tab bar along the bottom: the pipe's alerts under a large title, its one sentence glowing amber because two things wait on you; the investigator's runtime page with the procedure a person approved and what each command printed; the judge's board](docs/img/hookstack-phones.png) The three boards install on a phone as apps, read in Chinese or English and follow the system's light or dark; [the full tour](OVERVIEW.md) has every screenshot, from local runs and not mockups. diff --git a/README.zh-CN.md b/README.zh-CN.md index 1b0eb67..85fb7b7 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -30,6 +30,8 @@ - **半天，真上：**[STACK.md](STACK.md) 从源码一步步跑起三个服务；[docs/containment.md](docs/containment.md) 是指向真实集群**之前**要读的边界地图。 - **完整功能清单：**[docs/what-you-get.md](docs/what-you-get.md)（英文）。 +![hookprobe 的控制台：一次在 GLM-5.3 上的真实调查，结论在最前面，看到的事实和只能推断的分开写，花费在顶部](docs/img/zh/hookprobe-sessions.png) + ![三块看板装在手机上，都像一个 App，底部是毛玻璃标签栏：hookrelay 的告警页，大标题下那句话泛着琥珀色的光，因为有两件事等你处理；hookprobe 的运行页，一个有人批准过的处置步骤和每条命令的输出；hookjudge 的概览](docs/img/zh/hookstack-phones.png) 三块看板都能装到手机上当 App 用，能切换中英文，并跟随系统的浅色或深色；[完整介绍](OVERVIEW.md)（英文）里有全部截图，取自本地真实运行，不是效果图。 diff --git a/docs/img/hookprobe-audit.png b/docs/img/hookprobe-audit.png index 666af28..9626f95 100644 Binary files a/docs/img/hookprobe-audit.png and b/docs/img/hookprobe-audit.png differ diff --git a/docs/img/hookprobe-memory.png b/docs/img/hookprobe-memory.png index ff6e986..08b1f86 100644 Binary files a/docs/img/hookprobe-memory.png and b/docs/img/hookprobe-memory.png differ diff --git a/docs/img/hookprobe-sessions.png b/docs/img/hookprobe-sessions.png index b10511e..d5adaf2 100644 Binary files a/docs/img/hookprobe-sessions.png and b/docs/img/hookprobe-sessions.png differ diff --git a/docs/img/hookprobe-system.png b/docs/img/hookprobe-system.png index d579175..58453d7 100644 Binary files a/docs/img/hookprobe-system.png and b/docs/img/hookprobe-system.png differ diff --git a/docs/img/hookprobe-waterfall.png b/docs/img/hookprobe-waterfall.png index 07f8f43..fafbf28 100644 Binary files a/docs/img/hookprobe-waterfall.png and b/docs/img/hookprobe-waterfall.png differ diff --git a/docs/img/zh/hookprobe-sessions.png b/docs/img/zh/hookprobe-sessions.png new file mode 100644 index 0000000..c86852e Binary files /dev/null and b/docs/img/zh/hookprobe-sessions.png differ diff --git a/docs/index.md b/docs/index.md index 6f8c829..e0a4a3a 100644 --- a/docs/index.md +++ b/docs/index.md @@ -35,6 +35,8 @@ The investigator is the product. The pipe and the judge are the smallest alertin - **Half a day, for real:** [STACK.md](https://github.com/itswl/hookstack/blob/main/STACK.md) runs all three from source; [docs/containment.md](containment.md) is the boundary map you read *before* pointing it at a cluster. - **What it does, in full:** [docs/what-you-get.md](what-you-get.md). +![hookprobe's console: a real investigation on GLM-5.3, its conclusion first, what it observed set apart from what it could only infer, and its cost in the header](img/hookprobe-sessions.png) + ![the three boards on a phone, each laid out as an app with a frosted tab bar along the bottom: the pipe's alerts under a large title, its one sentence glowing amber because two things wait on you; the investigator's runtime page with the procedure a person approved and what each command printed; the judge's board](img/hookstack-phones.png) The three boards install on a phone as apps, read in Chinese or English and follow the system's light or dark; [the full tour](https://github.com/itswl/hookstack/blob/main/OVERVIEW.md) has every screenshot, from local runs and not mockups. diff --git a/docs/zh/index.md b/docs/zh/index.md index effa23e..0a41d50 100644 --- a/docs/zh/index.md +++ b/docs/zh/index.md @@ -33,6 +33,8 @@ description: 让 agent 值班，但不把钥匙交出去 —— 管道给每条 - **半天，真上：**[STACK.md](https://github.com/itswl/hookstack/blob/main/STACK.md) 从源码一步步跑起三个服务；[docs/containment.md](../containment.md) 是指向真实集群**之前**要读的边界地图。 - **完整功能清单：**[docs/what-you-get.md](../what-you-get.md)（英文）。 +![hookprobe 的控制台：一次在 GLM-5.3 上的真实调查，结论在最前面，看到的事实和只能推断的分开写，花费在顶部](../img/zh/hookprobe-sessions.png) + ![三块看板装在手机上，都像一个 App，底部是毛玻璃标签栏：hookrelay 的告警页，大标题下那句话泛着琥珀色的光，因为有两件事等你处理；hookprobe 的运行页，一个有人批准过的处置步骤和每条命令的输出；hookjudge 的概览](../img/zh/hookstack-phones.png) 三块看板都能装到手机上当 App 用，能切换中英文，并跟随系统的浅色或深色；[完整介绍](https://github.com/itswl/hookstack/blob/main/OVERVIEW.md)（英文）里有全部截图，取自本地真实运行，不是效果图。 diff --git a/hookprobe/docs/cost.md b/hookprobe/docs/cost.md index 7edb08b..cbd016e 100644 --- a/hookprobe/docs/cost.md +++ b/hookprobe/docs/cost.md @@ -255,7 +255,7 @@ harness — the part no bill itemises. `GET /v1/runs/{key}/telemetry` is the same shape as JSON, and the run's `/audit` record carries the totals. Nothing has to be deployed beside the service to see it. -![the waterfall under a finished run: five model calls on one axis, 25 seconds all spent waiting on the model, the tools between them, and the two costliest calls named as 72% of $0.21](../../docs/img/hookprobe-waterfall.png) +![the waterfall under a finished run: six model calls on one axis, 209 seconds all spent waiting on the model, the tools between them, and the two costliest calls named as 72% of $0.10](../../docs/img/hookprobe-waterfall.png) Three things about that record. Only the CLI this service launched can write it — the subprocess carries a per-process header the receiver checks, and diff --git a/hookprobe/hookprobe/ui.html b/hookprobe/hookprobe/ui.html index 225ba86..a39443a 100644 --- a/hookprobe/hookprobe/ui.html +++ b/hookprobe/hookprobe/ui.html @@ -629,6 +629,12 @@ they never narrow the title above them. */ .pane .row { grid-template-columns: auto minmax(0, 1fr) auto; grid-template-areas: "ttl ttl m1" "sub sub sub" "st m2 m2"; padding: 10px 14px; } .pane .row .st { align-self: center; padding: 0; } + /* A run with every flag (returned, refused N, a ruling) carried more chips + than its row is wide, and each chip broke inside itself — "refused" over + "1", "1" over "turn" (found 2026-11-12). A chip keeps its words together; + the row lets a chip that does not fit go to a line of its own. */ + .pane .row .m2 { flex-wrap: wrap; row-gap: 4px; } + .pane .row .m2 > * { white-space: nowrap; } .pane .row .sub { font-family: var(--mono); font-size: 11.5px; } .d-head { padding: 14px 18px 10px; border-bottom: 1px solid var(--border-soft); } .d-title { display: flex; gap: 10px; align-items: flex-start; }