@ankurkumarz/pi-gpu-sre-ops

A safe, runtime-configurable Pi package for GPU inference SRE, incident triage, token-efficiency analysis, and proposal-only optimization workflows.

What 0.1.0 includes

• gpu-incident-triage skill for evidence-based incident investigation.
• token-inference-optimization skill for prefill, decode, cache, scheduler, and capacity analysis.
• Runtime-neutral profile contract supporting vLLM, SGLang, Triton, TensorRT-LLM, TGI, and custom runtimes.
• Read-only tools for runtime profile lookup, inference health, token efficiency, and optimization proposals.
• Mock mode by default—no live request is made unless an authenticated Ops Gateway is configured.
• Proposal-only optimization plans with canary, approval, and rollback requirements.
• Guardrails that block destructive shell patterns and disable general shell execution in production.

Security boundary

This public package contains generic skills, schemas, mock data, and connector contracts only. Do not include client endpoints, credentials, kubeconfigs, raw production logs, raw prompts, private runbooks, or customer data.

A production Ops Gateway must enforce tenant/service authorization, RBAC, secret handling, query validation, redaction, audit logging, approval validation, and configuration rollout controls. The Pi package must never be the sole production security boundary.

Install

pi install npm:@ankurkumarz/[email protected]

For a project-local installation:

pi install -l npm:@ankurkumarz/[email protected]

Test locally

cp .env.example .env
pi -e ./extensions/index.ts

Without OPS_GATEWAY_URL and OPS_GATEWAY_TOKEN, all operational tools return clearly marked fixture data.

Example prompt:

Use gpu-incident-triage for incident INC-1234 in tenant personal-lab,
service llm-inference, environment dev, from 09:00 to 10:00 PDT.
Then use token-inference-optimization and draft a proposal-only canary plan.

Validate package contents

npm install
npm run publish:check

Review the npm pack --dry-run file list before publishing. It must not contain .env, credentials, customer information, private runbooks, or generated local artifacts.

Publish

npm login
npm whoami
npm publish --access public

After any published version, npm does not allow republishing the same name/version. Increment the version before the next release:

npm version patch
npm publish --access public

Client configuration model

Keep real, Git-versioned client runtime profiles in a private control-plane repository. Validate YAML with JSON Schema and policy-as-code in CI, then publish signed/traceable normalized profiles to an authenticated Ops Gateway. The agent should receive only the profile resolved for its authorized incident, tenant, service, and environment.