Open source · Self-hosted · Spec-driven with Specstride
// 01 · the loop
intent ─▶ ┌────────┐ CRs ┌─────────────┐ reconcile ┌────────┐
│ agents │ ────▶ │ controllers │ ────────▶ │ fabric │
└───▲────┘ └─────────────┘ └───┬────┘
│ gNMI telemetry │
└──────────────────────────────────────────┘
- agentic-netops: AGNTCY and LangGraph agents turn intent into Kubernetes CRs, controllers reconcile them onto a live SONiC EVPN/VXLAN fabric, and gNMI telemetry closes the loop. Runs in containerlab and kind.
- agentic-netops-srl: the same approach on Nokia SR Linux: a declarative EVPN/VXLAN fabric control plane with a guarded multi-agent intent tier.
- agentic-ops-bench: model-by-harness benchmark on real ops tasks (AIOps, NetDevOps, HPC, inference, RAG, tool loops). Local 30B-class models on one RTX 3090 against hosted frontier models.
// 02 · specstride
An agent that grades its own work says "done" when it isn't. Specstride takes a Spec Kit feature to done phase by phase, unattended: the engine runs the tests first, then a separate reviewer, an LLM judge with no tools, must approve the change, and every approval is a signed record and its own commit. Every loop has an end: capped attempts, named stop reasons, and a diagnosis before a retry.
┌────────────────────┐ ┌────────────────────┐ ┌────────────────────┐
│ Claude Code plugin │ │ dsh host │ │ plain shell │
└─────────┬──────────┘ └─────────┬──────────┘ └─────────┬──────────┘
└────────────────────────┼────────────────────────┘
CLI protocol v1 · argv in, exit code out
┌──────────▼──────────┐
│ specstride-core │ one pinned engine
└─────────────────────┘
implement ─▶ verify ─▶ review ─▶ commit ─▶ next phase
| Variant | Runs in | Pick it when |
|---|---|---|
| specstride-plugin · page | Claude Code | You work in Claude Code. Two skills, installed with two /plugin commands. |
| specstride-dsh · page | dsh, the DeepSeek Harness | You work in dsh. Three skills, a shim, a doctor and an eval driver over the pinned core. |
| specstride-core · page | Your shell | You run the specstride CLI on its own, or build a host for another agent. The engine, its contracts, loop layers, runtime and adapters. |
Install the plugin with /plugin marketplace add mairp/specstride-plugin, then /plugin install specstride@specstride-marketplace. All three are Apache-2.0 and run the same loop: same gates, same records, same commits.
- specstride-example: try it in five minutes on a tiny three-phase Spec Kit feature.
- specstride.ai: the website, with the loop, the judge and the three variants explained.
- specstride (Python): the earlier Python orchestrator, with an LLM critic gate, stuck-phase diagnosis and self-tuned per-phase settings. It built the core.
// 03 · built with specstride
The evidence is in each repository's history: the engine commits every approved phase itself, as specstride: phase N approved.
| Repository | What it is | Evidence |
|---|---|---|
| agentic-netops | Intent to a live SONiC EVPN/VXLAN fabric, with agents, controllers and gNMI telemetry | approved-phase commits, the early ones under the tool's former name |
| agentic-netops-srl | The same approach on Nokia SR Linux | approved-phase commits |
| specstride-core | The Specstride engine, built by the earlier Python Specstride | approved-phase commits |
| specstride-dsh | The dsh host and its Kanban tab | approved-phase commits |
| mixture-of-loops | Generates unattended Specstride pipelines from Spec Kit artifacts | the badge in its README |
| trustcircle | AI governance control plane | approved-phase commits, from the same critic gate under the loop's earlier name |
// 04 · governance
┌───────────┐ package ┌──────────┐ decide ┌──────────────┐
discover ─▶ │ inventory │ ──────▶ │ approver │ ─────▶ │ audit ledger │
└─────▲─────┘ └──────────┘ └──────┬───────┘
│ controls · evidence · readiness │
└──────────────────────────────────────────┘
- trustcircle: AI governance control plane. Keeps a continuously reconciled inventory of every AI asset inside a declared boundary, routes decision packages to people who actually hold the authority (separation of duties, no self-approval), turns failing controls into owned cases, and exports signed evidence packages an auditor can verify. Maps controls to ISO/IEC 42001, the EU AI Act and NIST AI RMF, and reports readiness, never certification. One script provisions it on Docker Compose or Kubernetes. Apache-2.0; UI tour, including the decision screens.
// 05 · harnesses
- mixture-of-loops: generates provenance-bound, unattended Specstride pipelines from Spec Kit artifacts, and ships specstride-batch to run that pipeline over batches of features at once.
- agent-observability-stack: self-hosted observability for LLM agents and the Linux host running them. Prometheus, Grafana, Loki, Tempo and OTel, with Arize Phoenix as a second trace backend for LLM calls. Metrics and traces for OpenClaw, LiteLLM, Claude Code and RAG.
- qmd-memory-stack and qmd-gateway: local GPU-accelerated three-tier RAG memory for coding agents, and a shared writable MCP memory gateway for a multi-agent fleet.
- claude-plugins: Claude Code plugin marketplace: antares-scan, mixture-of-loops, qmd-recall, gpu-ops, video-to-deck, speckit-batch and specstride. antares-scan does first-pass security triage of a code folder with a local Granite-4.0 1B model.
// 06 · labs
Containerlab labs for Nokia SR OS and SR Linux, built at Nokia and published under srl-labs.
- srl-sros-telemetry-lab: interactive streaming telemetry lab with SR Linux and SR OS, gNMI into Prometheus and Grafana.
- sros-anysec-lab: quantum-safe ANYsec encryption demo on SR OS FP5 vSIMs.
- sros-anysec-macsec-lab: quantum-safe ANYsec and MACsec together in one lab.
// 07 · physical ai
- nb-robotic-ai-hk: our team's work from the NVIDIA × Nebius "Sim to Table" hackathon (Berlin, October 2026): an SO-101 arm, Isaac Sim demos, Cosmos Reason curation, and GR00T N1.7 training on Nebius. The write-up is the honest account handed to the judges, including the closed-loop result of 0 of 9.
// 08 · the fleet
Skills, curated per session through skillOverrides profiles — these are the ones that stay on; the host-ops ones live in agent-skills:
- gpu-ops: operates and inspects the RTX 3090 eGPU — status, free VRAM, drain, safe power cycles — through proven scripts, never ad-hoc commands.
- speckit-batch: runs a Spec Kit command over a range of specs on a chosen harness and model, several features in parallel.
- speckit-* suite: the Spec Kit workflow I run daily across Claude Code and dsh — specify, clarify, constitution, plan, tasks, implement, analyze, checklist, converge, taskstoissues — one skill per artifact.
- specstride-reverse: reverse-engineers an existing codebase into a complete as-is Spec Kit feature (constitution, spec, checklist, plan, research, data model, contracts, ticked tasks) with
specstride reverse, so the pipeline can run on projects with no specs yet. - Specstride batch: runs the full Specstride / Mixture of Loops pipeline over a range of specs — one launch contract per feature, derived and executed unattended on Claude Code or dsh, model and reasoning pinned per run, a shared queue so two harnesses drain batches side by side.
- mixture-of-loops: derives the provenance-bound, unattended Specstride pipelines that Specstride batch launches.
- specstride-curate: curates and reconciles a Spec Kit spec corpus for a target host, unattended end to end — auto-research agents verify the host facts and distill aesthetic references into cited briefs, a deterministic script backs up and cross-checks, curation agents apply the retargeting rules, analyze reports refresh.
- jupyter-pull: pulls every file off a remote Jupyter server I am logged into, given only the pasted session cookie.
- spec-reconcile: writes a dated spec-vs-deployed sheet, read-only and in a fixed vocabulary — the drift audit between what a spec says and what is running.
- qmd-recall: recall from and write to the shared fleet memory, so every agent on the host inherits prior context and durable gotchas.
- fleet-control: brings the LLM and observability stack up or down and returns a fleet health digest.
- proxmox-ops and proxmox-triage: guarded lifecycle operations (snapshot before risky changes) and read-only diagnosis of Proxmox VMs and containers.
- local-model-ops: which local model to pick on the 3090, when to think longer, and when to escalate to a hosted frontier model.
Agents:
- Linky: drafts a LinkedIn post in my voice every morning and publishes only after I approve it (the link is the public demo).
- Local AI analyst: a weekly buy-or-wait read on local inference hardware against hosted frontier models, checked against written buy triggers and a ledger.
- Observability digest: a daily Telegram summary of the agent fleet and its host.
- Portfolio sync: keeps mairp.ai and its digital twin's knowledge base in step with my public repos, daily.
- Relay: a NetOps and infrastructure agent I reach over Telegram; it works cards from the kanban board.
- Eterna: agentic RAG over InfiniBand, RDMA, RoCE and HPC material.
- Havan: hunts flight deals and returns a ranked shortlist (the link is the public demo).
- Release watcher: polls upstream release tags every 15 minutes and fast-forwards my local clones, never merging or running repo code.
- video-to-deck: turns videos into Marp slide decks using local Whisper, OCR and a fresh agent per video.
- kanban: persistent kanban board with a Claude and Telegram front end.
- Digital twin: answers questions about my work on mairp.ai.
- duby: investment-analysis agent that monitors Telegram trading signals, enriches them with live market data, and serves position-sized analysis through a dashboard and a Telegram bot.
// 09 · sites
- mairp.ai: the website of my consulting practice, Network & AI Systems Consulting, live at mairp.ai. Built on the specstride.ai template.
- specstride.ai: the Specstride website, live at specstride.ai. Products, hosts and FAQ entries are data, so it doubles as a reusable Astro template (MIT).
// 10 · tooling
- kind-cilium-hubble-cluster: observable Kubernetes cluster with kind, Cilium and Hubble from scratch.
- gpu_rtx_3090: safe power-cycle scripts for an RTX 3090 Thunderbolt eGPU.
- certforge: small OpenSSL CLI for CSRs and self-signed certificates from a .cnf.