Oracle7-infrastructure

An AI that adapts to whatever it is pointed at. Installed on a system, Oracle7 finds out what is there, decides what to read, builds the same set of readers for everything it finds, and learns from that system's own future which forecasts it can trust. Every value it holds keeps the place it was read from. It proposes actions with a predicted effect and a dry run, runs nothing until a person approves it, and then checks whether the effect happened.

It contains no neural network. It is one Python file that uses only the standard library.

How it adapts

• To what is there. On each system it discovers the services, scheduled jobs, websites, certificates and ports by itself. The four servers it was first installed on held between 36 and 106 services each; it needed no configuration for any of them.
• To what it reads. Readers are generated for every signal it finds, so a new service or website is covered from its first reading.
• To how each system behaves. Forecasting methods are admitted per signal and per system, only after they have beaten "nothing changes" on that system's own future. On the first day it admitted a trend method for certificate expiry on one server, where the value falls steadily, and kept the simpler assumption everywhere the trend had not earned it.
• To other kinds of system. Anything that publishes numbers can be added as a source: JSON over HTTP, Prometheus metrics, or the output of a command. Those values get the same readers, forecasts and gate.

Install

sudo sh install.sh
python3 /opt/o7infra/o7infra_agent.py brief
python3 /opt/o7infra/desk.py "what is failing"

Requirements: Linux with systemd, Python 3.10 or later, root (to read the journal and service state). Optional: nginx (its sites and certificates are found automatically), openssl (certificate expiry).

What it does

Finds what to watch. With no configuration it lists the system's long-running services, its scheduled jobs, the websites nginx serves with their TLS certificates, and its listening ports.

Reads it. Host load, CPU, memory and swap; space and inodes on every disk; network traffic; for every service its state, memory, CPU and restart rate; whether every scheduled job's last run succeeded; journal errors per service; days left on every certificate; whether every website answers and how fast. Every value is stored as time, entity, signal, value and source.

Stays small. Raw values are kept 24 hours and ten-minute means 30 days, under a hard size cap (60 MB by default). The service unit limits it to 10% of one CPU and 150 MB of memory at the lowest CPU and I/O priority.

Reads every signal the same way. For whatever it finds it generates the same readers: current value, trend, time to threshold, anomaly against the signal's own history, and which signals shifted just before an event.

Tests its forecasts on the future. Every forecast is recorded when it is made and scored when its time arrives. A forecasting method is admitted for a kind of signal only after at least 30 scored forecasts beat the assumption that nothing changes by at least 10%. Until then its forecasts are labelled unproven. o7infra_agent.py gate shows the current record.

Proposes actions with their evidence. Each proposal carries the reading that prompted it, the expected effect and the output of a dry run. approve <id> then execute <id> runs one. After it runs, the agent checks the expected effect against the next readings. An action type may run without approval only after five executions whose effect matched, and only when the operator sets O7INFRA_AUTONOMOUS=1. By default it is off.

First deployment

Installed on four of our own servers on 12 October 2026. Within the first hour:

• It found 278 services, 165 scheduled jobs, 102 websites, 56 TLS certificates and 182 listening ports, with no configuration.
• It held 2,551 current readings, of which 39 were critical and 2 warnings.
• Six services were in crash loops, restarting between 63 and 695 times an hour; one had restarted 144,690 times in total.
• Two websites were down: one returning 502, one not answering.
• One server was at 97.3% disk and 100% swap.
• Certificate renewal was failing on two servers. Reading the certificates showed the soonest expiry was 51.5 days away.
• One website looked down because it does not answer HEAD requests. The agent now retries with GET; it answered 200.

Each finding is shown with its source, for example systemctl show NRestarts=144690, HTTPS HEAD status 502 or openssl x509 /etc/letsencrypt/live/<site>/fullchain.pem.

The same day:

• Two proposed actions were approved and run (clearing old system logs on two servers). The agent then measured their effect from its own readings: free disk went from 4.616 to 5.507 GB on one server and from 1.062 to 1.341 GB on the other. On the second server the log tool's own summary reported that it had freed nothing; the agent records what it measured. Both effects matched the prediction.
• 1,242 forecasts had been scored against what then happened. The gate admitted one method for one signal (certificate expiry, on one server) and refused the trend method wherever it had done worse than assuming no change.

Talking to it

python3 /opt/o7infra/desk.py "when will the disk fill"
python3 /opt/o7infra/desk.py "when do certificates expire"
python3 /opt/o7infra/desk.py "what should I do"
python3 /opt/o7infra/desk.py --repl

Questions outside the system can go to the Oracle7 core if you have it: desk.py --oracle7 /path/to/oracle7-slim "<question>". See oracle7-slim and oracle7.

Other systems

Anything that publishes numbers can be read by adding it to /etc/o7infra/sources.json: JSON over HTTP (a value by its path), Prometheus metrics (by name pattern), or the output of a command (by pattern). See sources.example.json. Those values get the same readers, forecasts and gate.

Several servers: fleet.py host1 host2 ... asks each host's agent over SSH and prints one view.

The Oracle7 family

Oracle7-infrastructure is one of several systems built the same way: read what is there, keep a receipt for every reading, admit a method only after it is measured, and decline what cannot be checked. Each was frozen and then measured once on data it had not seen.

Pointed at	Repository	Held-out result, measured once
Servers and services	oracle7-infrastructure (this)	first deployment above
Questions, with 267 domain specialists	oracle7, oracle7-slim	sealed release test 17: 111 right, 5 wrong, 1 false yes of 150 (slim: 108 / 3 / 1); precision 95.3% / 97.5%
Simulated spacecraft faults	oracle7-deepspace	right action in 98.9% of 1,700 fresh scenarios, none harmful; a simplified limit-to-safe-mode baseline 29.4%
Routing decisions	oracle7-trafficcop	30 of 32 held-out cases; both misses were abstentions
Website and repository reconstruction	oracle7-chameleon	1 of 4 held-out repositories complete on first pass; 0 false completions
Images	oracle7-vision	MNIST 98.6%, Fashion-MNIST 90.5%, CIFAR-10 63.0%; ScreenSpot clicks 21.3%
Text to image	oracle7-artist	GenEval-style 50.9% on 2,212 images, every object a cited COCO instance

None of them uses a neural network at inference. Each repository states its failures alongside its results.

Limits

• Forecasts are unproven until the gate has scored enough of them on each system; on the first day most were still unproven.
• Actions are recommendations unless a person approves them. Two actions have been run and verified so far.
• Tested on four Linux servers running systemd. The sources file has not yet been used on outside systems.
• Each host runs its own agent; fleet.py joins them by SSH.
• Website checks request the site's home page only.

Licence

Apache-2.0. Oracle7's core and its knowledge stores are released separately under their own terms.