Observe completely
Read every page from both sides and stop the entire run when observation is incomplete.
Control loop
Safety is structural, not a checklist.
DonkeyFleet turns intent and observation into bounded work.
Each boundary has a durable record and a visible operator outcome.
Decide with guardrails
Apply age, action, bandwidth, placement, policy, and orphan-transition limits before work is eligible.
Authorize explicitly
Keep human approval separate from execution, with auto mode restricted to eligible new protection and fill growth.
Resume durably
Persist intent and ONTAP job identity before polling so interrupted work resumes instead of being duplicated.
One explainable path
Approval authorizes. Reconcile executes.
Browser actions never call ONTAP directly. The next reconcile re-observes identity and policy, then executes only when the approved payload is still valid and effective dry-run is off.
Follow an approval through Apply- Observe
- Evaluate
- Decide
- Approve
- Apply
- Audit
Deploy at your scale
One image, two operating footprints.
Standalone stack
Docker Compose bundles PostgreSQL, dev-mode Vault, dev-mode Keycloak, and DonkeyFleet for a compact trial.
- Best for demos and small footprints
- Fixed development credentials
- Persistent PostgreSQL volume
Kubernetes
Run one controller replica with external PostgreSQL, Vault, and OIDC for a production control plane.
- External persistent services
- Helm-managed runtime safety
- PostgreSQL advisory locking
