Action packs

Deep Postgres operations — activity introspection, session/lock diagnostics, table + index analytics (bloat, dead tuples, unused indexes), WAL + replication state, progress views, EXPLAIN, and a curated set of operator-tier mutators (cancel/terminate backend, ANALYZE, VACUUM, REINDEX CONCURRENTLY). Authenticates via PG* env vars on the runner host.

Read-only MySQL diagnostics plus narrow operator actions for killing queries, flushing logs, and analyzing tables. Authenticates via ~/.my.cnf or MYSQL_PWD env var on the runner host — never via per-call credentials over the wire.

Replica-set + shard-cluster introspection, slow-query identification, collection stats, plus remediation surface (killOp, replSet stepDown, collection compact, dropIndex). Authenticates via MONGO_URI env var on the runner host.

Deep Redis ops — INFO + memory accounting, slowlog + per-event latency, command stats, client list/kill/pause, keyspace introspection (SCAN, TYPE, TTL, OBJECT encoding/refcount/idle/freq, MEMORY USAGE), config get/set/rewrite/resetstat, ACL list/whoami/getuser, cluster topology (info, nodes, slots, slot-count, check), cluster operators (failover, forget, replicaof), Sentinel HA topology (masters, master, replicas, sentinels, get-master-addr, ckquorum, is-master-down, Sentinel INFO) and operators (failover, reset), persistence (lastsave, bgsave, bgrewriteaof, memory purge/doctor), streams + pub/sub introspection, script cache flush, and tier-critical actions (flush_db, flushall, swapdb, shutdown_nosave). Sentinel actions target the Sentinel on port 26379; all others default to 127.0.0.1:6379. Authenticates via REDISCLI_AUTH / REDIS_* env vars on the runner host — never via per-call credentials.

Deep Cassandra ops via nodetool + cqlsh: topology (status, ring, gossip, describering, failure detector), health (tpstats, netstats, proxy + table histograms, compaction stats + history, GC, clients, hot and large partitions, tombstones), schema introspection down to one table, effective runtime configuration, approval-gated data reads, runtime limits a running node accepts without a restart (stream and inter-datacenter throughput, compaction, hints, batchlog replay, snapshots, request timeouts, caches, stage concurrency, tracing), switches for compaction, hints, and backup, maintenance mutators (snapshot, flush, cleanup, verify, compact, scrub, garbage collect, upgrade + relocate SSTables, cache invalidation), repair workflows, node lifecycle (drain, decommission, assassinate, removenode, rebuild, bootstrap resume), default-denied native transport and gossip switches, and logging level control. JMX on 127.0.0.1:7199.

ClickHouse server + table introspection — metrics, errors, slow & failed queries, parts/partitions, merges, mutations, replication queue, Keeper/ZK health, detached parts, distributed-send backlog, backups — plus narrow mutators (OPTIMIZE, KILL QUERY, SYSTEM RELOAD CONFIG, replica ops). Auth via CH_HOST + CH_USER + CH_PASSWORD env vars on the runner host. Uses clickhouse-client with --query to keep arg surface minimal.

Investigate a CockroachDB cluster over the `cockroach` CLI — node liveness / store capacity, under-replicated & unavailable ranges, running queries / sessions / transactions, contention & locks, jobs, statement statistics, table sizes, and cluster settings — plus a few gated operators (cancel a query / session / job, pause / resume a job, decommission / recommission a node). Reads are SQL against crdb_internal / SHOW statements; mutators use SQL or `cockroach node`.

Cluster + index introspection plus narrow mutators (cache_clear, force_merge, flush, close_index). Auth via ELASTIC_USER + ELASTIC_PASSWORD env vars on the runner host. Does NOT include delete_index — too easy to misuse.

Read-only memcached introspection via the `stats` ASCII protocol — general stats, slab usage, item counts, sizes. Plus FLUSH_ALL as a critical mutator. Target host/port via MEMCACHED_HOST + MEMCACHED_PORT env vars on the runner host (default 127.0.0.1:11211).

Read-only diagnostics for a Typesense search node over its HTTP API: health and node/raft state, per-endpoint request stats and system metrics, the collection catalog and individual schemas, API-key metadata, and a tail of slow requests from the server log. One admin API key, streamed over curl stdin, unlocks the stats/metrics/debug endpoints a search-only key cannot read.

Topic introspection, consumer-group lag, broker config, ACLs, and narrow mutators (reset_offsets, alter_topic_retention, delete_consumer_group, preferred_leader_election). Auth via KAFKA_BOOTSTRAP env var on the runner host plus optional KAFKA_COMMAND_CONFIG (jaas / SASL / SSL).

Cluster, queue, exchange, binding, connection, channel, and consumer inventory plus narrow operator actions (purge_queue, set_policy, force_close_connection). Uses rabbitmqctl + rabbitmqadmin on the runner host.

Cluster + 4lw command + watch + session introspection. Read-only. Set ZK_SERVERS env var (host:port,host:port,…). All four-letter words need to be in zoo.cfg's `4lw.commands.whitelist`.

Operator pack for Docker hosts: read-only inventory and per-container introspection, plus narrow mutators (restart, stop, kill, prune). Includes docker-compose support. The runner uid must be in the docker group; this pack does NOT escalate.

Read-only inventory + per-container introspection plus narrow mutators (restart, stop, kill, prune). Drop-in alternative for Docker on RHEL / Fedora hosts. Rootless mode supported as long as the runner uid matches the user that owns the containers.

Operator pack for Kubernetes clusters: discovery (pods, nodes, services, deployments), deep introspection (describe, logs, events), rollouts (status, history, restart, undo), and narrow node/pod mutators (cordon, drain, delete). Cluster targeting via KUBECONFIG env var on the runner host; context selectable per call.

Deep Nomad operations — full job lifecycle (inspect, history, scale horizontally + vertically, dispatch, revert, promote, stop + start again, batched whole-job restart, forced re-evaluation), meta-filtered discovery (list jobs with their meta stanza, or every allocation of e.g. managed_by=terraform jobs, filtered server-side), per-task CPU/memory resource read + set, allocation introspection + health checks + filesystem ls/stat (metadata only, never file contents) + fixed in-container Redis probes (ping/info via alloc exec, no freeform command) + restart + signal + stop, bounded job health snapshots, job-spec-declared actions (run a command the job author defined), native service discovery (no Consul) — every namespace-bound action takes an optional namespace, and high-use reads also take an optional region — node fleet management (drain, eligibility, purge), node pools, evaluation + deployment status and control (pause, resume, fail/abort a rollout), operator raft + autopilot, CSI volumes + plugin health, host volumes, variable metadata (never values), ACL policies + tokens, namespaces + quotas. Authenticates via NOMAD_ADDR + NOMAD_TOKEN (and the standard TLS env) on the runner host.

RKE2-specific host introspection that kubectl can't give you — embedded-etcd live health (etcdctl endpoint health/status) and snapshot history, node certificate expiry, and the RKE2-bundled containerd via crictl (containers, pods, images). Runs on an RKE2 server node. Generic Kubernetes API reads are in the kubernetes pack; rke2-server / rke2-agent unit status and logs are covered by the linux-core / systemd-deep packs (systemctl status rke2-server, journalctl -u rke2-server).

Deep Consul ops — agent self/metrics/host introspection, operator raft + autopilot + reload, catalog (services + nodes + datacenters), health (passing/warning/critical) with force-pass/fail/warn check mutators, KV (get/list/recursive), ACL tokens/policies/roles, Connect mesh (CA roots, intentions), sessions, prepared queries, snapshots (save/inspect/restore), and narrow operator actions (deregister, maintenance, raft remove-peer). Auth via CONSUL_HTTP_ADDR + CONSUL_HTTP_TOKEN env vars.

Server status, target health, alertmanager linkage, instant + range queries, rule listing, TSDB stats, plus admin-API actions for remediation: reload config, take snapshot, clean tombstones, delete series. Admin endpoints require --web.enable-admin-api + --web.enable-lifecycle.

Grafana admin-API ops — datasource health, dashboard listings, alert state, user list, version, settings. Read-only. Auth via a bearer token or Basic credentials on the runner host.

Read-only PromQL / MetricsQL access to VictoriaMetrics over its HTTP API: instant and range queries, series and label discovery, and the VM-specific status endpoints (TSDB cardinality, active queries, top queries). One base URL serves single-node, cluster (vmselect), and vmauth-fronted deployments.

Read-only LogsQL access to VictoriaLogs over its HTTP API: search log entries, hit histograms over time, stats aggregations (instant + range), and field / stream discovery. Every request has an enforced trailing time window. One base URL serves single-node and vmauth-fronted deployments; multitenancy via optional headers.

Read-only ops for a Vector (vector.dev) pipeline running on the runner host: version + compiled-component inventory, offline config validation, the configured topology as Graphviz DOT, a bounded live event tap, plus health and per-component throughput reads over the local API. CLI subcommands talk to the local binary; the API reads hit 127.0.0.1:8686.

Operator pack for nginx — read-only status + access-log analysis, TLS cert probes, and narrow operator actions (test_config, reload, graceful quit, stop). Full restart is intentionally not included; use systemd for that.

Apache version, modules, mod_status snapshot, config syntax check, vhost dump, error/access log tails, plus narrow mutators (graceful reload, graceful stop). Full restart not included — use systemd for that.

Caddy v2 ops via its admin API (default http://127.0.0.1:2019) and CLI. Config dump, upstream health, PKI inventory, config validation, plus reload (live config swap). Set CADDY_ADMIN env var if not on default.

Stats, server state, frontends/backends, session inventory, plus narrow mutators to enable/disable backend servers. Talks to the HAProxy admin socket. Set HAPROXY_SOCK env var on the runner host.

Read-only visibility into a Traefik (v2/v3) edge router over its HTTP API: the overview, entrypoints, and the full HTTP/TCP/UDP router + service + middleware inventory (each carrying its status and error list, so you can see which router is broken), a compact per-service health summary, plus a per-host readiness check that joins the router and service views into one cutover-preflight verdict, the raw dynamic-config dump, version, liveness ping, and Prometheus metrics. ACME/Let's Encrypt certificate state is read from the on-disk acme.json (no API exposes it), and access-log 4xx/5xx tails mirror the nginx pack. Default API at http://127.0.0.1:8080 (api.insecure mode); override via TRAEFIK_URL.

Envoy admin-API ops: cluster + listener + runtime + config + cert inventory, server info, logging level read/write, plus traffic-shifting mutators (drain listeners, healthcheck fail/ok, reset counters) for planned failovers and incident response. Default admin URL http://127.0.0.1:9901; override via ENVOY_ADMIN env.

PHP runtime + FPM pool introspection — version, modules, ini, pool status (via fpm_status endpoint), error + slow logs, OPcache state, Composer manifest. Read-only. Set PHP_FPM_STATUS_URL env to point to the FPM status endpoint.

EC2 instance inventory + state introspection plus narrow mutators (stop, start, reboot, terminate). Auth via AWS_PROFILE + AWS_REGION on the runner host.

Read-only S3 diagnostics for bounded bucket and object inventory, access, ownership, policy, logging, replication, lifecycle, encryption, versioning, and fixed object metadata. Object bodies and custom metadata values are excluded. Auth via AWS_PROFILE.

Read-only RDS diagnostics for bounded instance, cluster, snapshot, parameter-group, pending-maintenance, and recent-event inventory. Responses are projected to operational fields and omit tags and arbitrary descriptions. Auth via AWS_PROFILE.

IAM introspection — users, roles, policies, attached policies, access keys — plus incident-response mutators: deactivate access key, delete access key, detach user policy. Auth via AWS_PROFILE. Routine IAM changes belong in IaC; these actions are for emergency lockout.

Metric + alarm + log group + log stream + log query introspection. Read-only. Auth via AWS_PROFILE.

Read-only AWS spend introspection — month-to-date by service, by account, forecast, and cost history over a trailing window by dimension. Auth via AWS_PROFILE with ce:* permissions. Cost Explorer must be enabled.

Google Cloud Compute diagnostics plus governed recovery mutations: VM instance and managed-instance-group reads, instance start/stop/reset/delete, and MIG resize. Load-balancer diagnostics live in the gcp-load-balancing pack. Every action names the target project and zone or region explicitly and uses fixed gcloud commands; mutations return their operation without waiting and are polled with gcp.operation_status.

Cloud SQL diagnostics for instances, databases, users, backups, operations, server CA certificates, and Query Insights query rankings, plus governed instance restart and high-availability failover. Fixed projections omit passwords, replication credentials, database-flag values, labels, descriptions, and certificate PEM. Mutations return their operation without waiting and are polled with gcp.sql_operation_describe.

Read-only Cloud Storage diagnostics for buckets, IAM policies, bounded object listings, and fixed object metadata. Object bodies, custom metadata values, contexts, signed URLs, and credential operations are excluded.

Read-only Google Cloud VPC, subnet, firewall, route, address, Cloud Router, Cloud NAT, VPN, and Interconnect diagnostics. Outputs are fixed projections that omit arbitrary descriptions, labels, and credential-shaped fields.

Read-only Google Cloud load-balancer topology and health diagnostics for backend services, health checks, URL maps, target proxies, forwarding rules, and network endpoint groups. Fixed projections exclude IAP secrets, AWS-auth keys, and custom header values.

Cloud DNS diagnostics plus governed exact-record control: managed-zone, DNSSEC, server-policy, response-policy, and exact-record reads, and upsert or delete of one exact record set with explicit zone, name, type, TTL, and value semantics. Zone-wide record dumps and arbitrary change batches are intentionally excluded.

Read-only Google Cloud project discovery and IAM diagnostics for workload identity providers, workload identity pools, and service-account policies. Discover projects visible to the authenticated identity, then use their project IDs with the project-scoped GCP actions.

Read-only diagnostics for legacy Compute SSL certificates and Certificate Manager certificates, maps, entries, and DNS authorizations. Fixed projections omit certificate PEM, private keys, descriptions, and labels.

Google Cloud Logging and Monitoring diagnostics plus governed alert control: bounded log discovery and queries, metric queries, metric descriptors, Cloud Interconnect attachment utilization, and alert-policy reads, and enable or disable of one exact alert policy. Logging and metric reads plus the alert-policy mutations use stable Google Cloud REST APIs — the mutations patch only the policy's enabled field; the alert-policy list uses the GA gcloud command.

Governed Cloudflare zone, DNS record, cache-purge, security-posture, TLS, analytics, tunnel, load-balancer, Workers, Pages, and audit-log operations. Auth via CF_API_TOKEN on the runner host.

Read-only Terraform or OpenTofu CLI actions for inspecting a workspace. NO apply, NO destroy, NO state mutation — those should happen in CI, not via a runner. Operates in the directory given by TF_DIR env var, running whichever CLI TF_BIN names — `terraform` by default, `tofu` on an OpenTofu host, so one of those two must be on PATH.

Review HCP Terraform (formerly Terraform Cloud) and Terraform Enterprise runs and gate what happens next: list workspaces and runs, project a run's plan into a summary that carries no resource or output values but does identify the bounded attribute paths that force replacement, read why a run failed from a bounded tail of its plan or apply log, queue a speculative plan-only run, retry a failed run against its exact configuration version, and confirm, discard, or cancel a run through emisar's policy and approval path instead of the HCP UI.

Authoritative/recursive BIND ops: rndc status + stats, zone validation, cache inspection, local resolution probes, plus narrow operator actions (rndc reload, zone freeze/thaw). Requires rndc key on the runner host.

Query the local FRRouting daemons via vtysh — BGP summary + neighbors, BFD peers, IP route summary, and interface state — plus one gated mutation: shut a BGP neighbor to drain a node from an anycast VIP and re-advertise to it afterwards. Reads are `show` commands; the drain is policy-gated (risk: high) and its reversal ships beside it.

iptables, nftables, conntrack, and traffic-control inspection plus narrow operator actions for incident response (block IP, unblock IP, flush chain). Rule edits are not persisted across iptables service reload — use IaC for permanent rules.

Operate a pfSense firewall over its REST API: read firewall rules, NAT, aliases, virtual IPs, interface / gateway (config + status) / service / VPN status, DHCP leases, routes, ARP, CARP, pf tables, installed packages, the config-change history, and firewall / system / auth / DHCP / OpenVPN logs, plus a few gated mutators (apply filter, flush states, restart a service, reboot). Uses the community pfSense-pkg-RESTAPI package (/api/v2), which runs on the firewall and works across CE and Plus.

WireGuard state — interfaces, peers, transfer counts, last handshakes — plus operator actions: bring iface up/down via wg-quick, remove a peer from a live iface. Use to debug connectivity or evict a compromised peer.

Inspect the host's Tailscale node via the tailscale CLI: tailnet status and peer/online map, network connectivity (netcheck DERP latency, port-mapping), ping to peers, whois lookups, this node's tailnet IPs, version, available exit nodes, MagicDNS/DNS config, and the current prefs (advertised routes, configured exit node). Read-only.

Read a network device over SNMP with the net-snmp CLI — system group, interface table, BGP peers (BGP4-MIB) and OSPF neighbors / general group (OSPF-MIB), plus a generic single-OID get and a bounded subtree walk. The routing reads exist to give operators visibility into BGP / OSPF state on devices this control plane can't reach by a native API — e.g. a pfSense + FRR edge firewall, where the REST API exposes no routing-protocol state. All read-only.

Monitor and operate a Dell iDRAC over its Redfish REST API with curl — system identity and health rollup, the Dell subsystem rollup, storage controllers and drives, power and thermal telemetry, firmware inventory, the System Event Log and Lifecycle Controller log, and the Lifecycle Controller job queue. Plus gated mutators: power control (ComputerSystem.Reset), clear / delete a job, and clear the SEL. Targets an iDRAC by hostname/IP; credentials come from the runner environment. Reads are read-only GETs.

Out-of-band BMC monitoring and power control over IPMI 2.0 (RMCP+/lanplus) with ipmitool — sensor data records, full sensor readings with thresholds, the System Event Log (SEL) and its summary, chassis + power state, FRU inventory, BMC firmware (mc info) and self-test, LAN config, and DCMI power draw. Plus gated mutators: chassis power control, one-time boot device, and SEL clear. Targets a Dell iDRAC or any IPMI-over-LAN baseboard controller by hostname/IP; credentials come from the runner environment. Reads are read-only.

Inspect physical network interface cards via ethtool: driver and firmware versions across every NIC (the "what firmware is my i40e fleet running?" check), plus per-interface link settings, hardware counters, offload features, and ring-buffer sizes. Read-only — no ethtool SET operations.

Inspect Linux network bonding / LACP: list bond interfaces, read a bond's full status from /proc/net/bonding (mode, LACP actor/partner state, per-slave link status), and show link-layer details. Read-only.

DNS lookups, reachability probes, TLS certificate inspection, and HTTP timing tests. All read-only. Use for "is X reachable?" and "what's the cert expiry on Y?" questions.

Active network throughput measurement with iperf3 — TCP bandwidth and UDP jitter / packet loss — between two nodes in the fleet. Run the one-shot server on one runner, then probe it with the client from another. Use to answer "what is the real bandwidth (or loss) between these two hosts?"

Inspect TLS certificates and keys on the local filesystem — find PEMs under a path, dump x509 details, check chain, verify private-key match, inspect PKCS#12. Read-only. Pair with `network-tls` for the remote-side view.

Clock-sync state for a Linux host on either time daemon: Chrony tracking and sources, the NTPsec peer table, current time, drift estimate, timezone, plus fix actions (chronyc makestep, enable/disable NTP). Use when a host's clock is drifting (a common cause of TLS / auth / log-correlation bugs).

Pool status, dataset inventory, snapshot listing, scrub status, ARC stats, plus operator surface for storage incident response: scrub start/stop, clear pool errors, take/destroy snapshots, dataset rollback.

Inspect a host's NFS exports, mounted shares, RPC state, active client connections. Plus two narrow operator actions: exportfs -r (re-export) and exportfs -u (unexport one client:path — evicts that client). Read-only otherwise.

Inspect the host's iSCSI initiator (open-iscsi): active sessions, per-session detail (targets, connections, negotiated parameters), configured target nodes, and initiator interfaces. Read-only.

Inspect device-mapper multipath: the multipath topology (multipath -ll), the effective config (multipath -t), and live path + map state queried from the running multipathd. Read-only.

Read-only access to a Pure Storage FlashArray over its Purity//FA REST API 2.x: array identity / capacity / performance, per-volume, per-host and per-interface performance with an optional history window, alerts, controller and hardware / drive health, volumes and per-volume space, protection groups, snapshots and membership, the host -> volume -> LUN connection map, host and target-port identities, per-controller network interface state, and replication / array-connection status. Drives a remote array via curl; every call is a GET.

Cluster + bucket + user introspection plus operator surface (user enable/disable, bucket heal, cluster service restart). Talks to mc CLI configured via MC_HOST_<alias> env var on the runner host.

Read-only inspection of a zot OCI registry over its HTTP API: the OCI distribution endpoints (version check, catalog, tags, manifests) plus the zot extensions — registry config/health (mgmt), Prometheus metrics, and a GraphQL search query that returns per-repo size and a newest-image vulnerability summary. Optional basic-auth credentials are streamed over curl stdin; many zot deployments allow anonymous read.

Generic filesystem operations an LLM-driven runner needs constantly: bounded find, recursive grep, file head/tail/hash, du, ls -la, stat. All read-only. Paths are validated against simple patterns; the runner's symlink-containment + audit redaction layers still apply on top.

Read-only Linux diagnostics plus narrow service control. Disk, mem, uptime, journalctl, log grep + tail, users/auth introspection, cron audit, network state, kernel info, and systemctl control. The front-line pack every Linux host gets.

Deeper systemd state than linux-core: failed units, list-units, timers, cgroup tree, journal disk usage, systemd-analyze for boot diagnosis, plus the operator surface linux-core does not carry (daemon-reload, kill -s signal, mask/unmask, reset-failed). The start/stop/restart/reload lifecycle lives in linux-core, which every host installs.

Operator pack for Debian/Ubuntu hosts. Read-only inventory and patching diagnostics, plus narrow apt install/remove actions for a single named package. Designed for production hosts where a human approver must see the package name before a write happens.

Counterpart to the `debian` pack for RHEL/CentOS/Fedora/Alma/Rocky: rpm inventory, dnf check-update, narrow install/remove actions for a single named package. Equivalent risk model to the apt counterpart.

General-purpose Linux diagnostics + low-level remediation: process and memory tops, vmstat/iostat snapshots, socket inventories, per-PID inspection, kernel-state checks, network reachability, plus fix-it actions (drop_caches, kill_pid by signal, sysctl_set). Use as the first-touch pack when something is wrong.

Deep per-process diagnostics for "why is this process stuck / slow / leaking?" — strace (HIGH RISK; slows the target), pid memory maps, per-thread state, /proc walking, gdb backtrace, full lsof, syscall summary. Read-only — but strace and gdb attach via ptrace and WILL slow the target.

cloud-init introspection + boot diagnostics + stage re-runs. Use when an EC2/GCE/Azure VM finishes booting but the workload didn't come up the way it should: check overall status, blame slow modules, dump user-data / cloud-config / vendor-data as the instance actually saw them, tail the cloud-init logs, and (with operator approval) re-run individual modules or the full init pipeline.

Queue inspection, config dump, log tailing, plus narrow operator actions (flush, requeue, delete-by-queue-id). These mutators are high- or critical-risk; the reversible hold/release pause is medium. All are audited. Queue inspection and mutation run as root because the runner's no-new-privileges boundary prevents Postfix helpers from elevating.

JVM diagnostics via jcmd/jstack/jmap/jstat/JFR. Requires runner uid and gid to match the JVM process owner — actions return a permission error cleanly when the identity doesn't match.

PM2 process inventory + logs + per-app introspection, plus narrow mutators (restart, reload, stop, scale). Requires the runner to be the same uid as the PM2 daemon (or set PM2_HOME).

Inspect a Python deployment — interpreter + venv state, pip inventory + freeze, dependency conflicts, outdated packages, sys.path. Read-only. Most actions act on the venv at PY_VENV env var (default /opt/app/venv).

Read-only git operations against a checkout living on the runner host (e.g. /opt/myapp). For remote-GitHub-API work, see the `github-cli` pack. The repo directory must live at GIT_REPO env var on the runner host.

GitHub introspection — PRs, issues, repos, workflow runs, releases, commit checks, search — plus operator actions: merge PR, close PR, rerun workflow, dispatch workflow. Authenticates via the runner host's `gh auth status` token (i.e. ~/.config/gh).

Synthetic pack that demonstrates every action-schema feature in one place: all arg types, every validation, both parsers, both kinds, opts envelope bounds, and per-action redaction rules. Not a production pack — use it as a reference when authoring real ones.

Vault status, seal state, auth/audit/secret backends, mount listing, token & lease introspection, plus operator surface for incident response: revoke lease, revoke leases by prefix, operator step-down, emergency seal. Auth via VAULT_ADDR + VAULT_TOKEN on the runner host. Does NOT include unseal — that requires quorum and shouldn't be automated through a runner.

fail2ban inventory + per-jail banned-IP listings plus operator mutators for incident response: ban an IP into a jail, unban a false positive, reload jail filters from disk.

STAGING-ONLY BREAK-GLASS. Runs an arbitrary operator-supplied shell script on the runner host via `/bin/sh -c`. This is the one capability emisar is built to avoid: it bypasses the declared-action model entirely — whatever the script says, runs, as the runner's user. It exists so an agent can verify a fix interactively on a staging host before that fix is encoded as a proper declared action or runbook. DO NOT install this pack on production runners and DO NOT enable it in production. Its single action is critical-risk, so the default policy denies it until an operator deliberately opts in; every run is fully audited.

Governed Apache Airflow 2 and 3 operations over the stable REST API: scheduler/triggerer/dag-processor health and job heartbeats, DAG inventory and per-DAG detail, run and task-instance search across every DAG, task logs, import errors and DAG warnings, pools, asset events, connection and variable inventory (names and routing only — never values), and the incident controls an operator actually reaches for: pause and unpause a DAG, trigger a run, mark a run or task succeeded/failed, preview then perform a clear, retune a pool, and start, pause, or cancel a backfill. Airflow 2 uses API v1 and Basic authentication; Airflow 3 uses API v2 with AIRFLOW_API_TOKEN or a JWT minted from AIRFLOW_USERNAME/AIRFLOW_PASSWORD. Jobs, assets, and backfills require Airflow 3.

JFrog Artifactory ops reads — health, version, license, storage usage, repository listings, artifact info and download stats, background tasks. Read-only. Auth via an access token or Basic credentials on the runner host.

Investigate Braintree payment failures, duplicate charges, refunds, recurring billing and disputes, and perform reviewed billing corrections.

Governed bunny.net Pull Zone lifecycle, cache, hostname, access-control, statistics, request-log, origin-error, and billing-usage operations. Auth via BUNNY_API_KEY on the runner host.

Look up data and run day-2 operations in a Databricks workspace over its REST API: run a bounded read-only SQL statement on a SQL warehouse, browse Unity Catalog down to a table's columns, read the datasets behind an AI/BI dashboard, watch job runs and fetch a failed run's error output, and start, stop, or restart the compute — warehouses, jobs, and clusters — through emisar's policy and approval path instead of the workspace UI.

Diagnostics for Elixir and Erlang/BEAM applications on the runner host or inside Docker containers: toolchain versions, EPMD registrations, BEAM OS process state, Linux /proc memory and process-tree detail, release RPC snapshots, supervisor/process/ETS/allocator/scheduler/port introspection, binary-leak checks, and bounded recon_trace call tracing. Releases are discovered from running BEAM processes; target one by release name, or by container for a release inside Docker.

Read-only Google Cloud spend analytics — cost by service, project, and SKU, a daily trend, and export freshness — read from the Cloud Billing export in BigQuery, alongside billing account, linked project, and budget reads from the Cloud Billing API. Google Cloud publishes no cost-report API, so the cost actions read the billing export rather than a reporting endpoint.

Generic read-only OpenID Connect discovery and JWKS diagnostics, plus local key-ID comparison and protected JWT-header inspection. Network actions use explicit HTTPS URLs, never follow redirects, and never submit bearer tokens.

Governed Sentry issue triage, release, ingest-key, volume-stats, and alert-rule operations against sentry.io or a self-hosted instance. Auth via SENTRY_AUTH_TOKEN on the runner host.

Governed Apache Spark operations over the HTTP surfaces a cluster already exposes: the monitoring REST API (/api/v1) on a live driver UI and on the history server — applications, jobs, stages with task-quantile summaries and task lists, executors with memory and GC, SQL executions, cached RDDs, and live executor thread dumps — plus the standalone master's cluster state and the standalone REST submission server. The controls are the ones an operator reaches for during an incident: kill a runaway job or stage on the driver, kill an application or driver from the master, decommission a worker, and kill a REST submission. Reads name their source (driver or history) because only a live driver knows a running application and only the history server keeps a finished one.

Investigate Stripe payment failures, duplicate charges, refunds, recurring billing and disputes, and perform reviewed billing corrections.

Debug native crashes with Symbolicator and keep the host it runs on healthy. Symbolicate a stack trace, a minidump, or an Apple crash report against the debug files the operator's configured sources hold, follow a request that runs long, and manage what that costs: liveness, build version, the cache footprint filling the disk, and the cleanup — previewed before it runs. Nothing here can publish or alter a symbol; Symbolicator has no ingest path. For the Sentry API itself, see the sentry pack.