ReckonReckon

Reckon is a read-only workspace for talking to production infrastructure. It gives a coding agent a carefully scoped toolbelt for investigating incidents, correlating signals, and producing root-cause analyses without turning unrestricted shell access into the safety model.

For production debugging, the hard problem is not another agent framework. It is environment design: which systems the agent can reach, how credentials are isolated, where writes are blocked, and when the operator should feel deliberate friction.

Each clone is pinned to a single environment. Credentials live inside that clone through XDG-aware configuration and explicit AWS paths, so production and staging sessions cannot accidentally share authentication state.

Reckon connects observability, deployments, cloud resources, message brokers, orchestration, caches, and databases. Purpose-built Go CLIs expose Grafana, Jenkins, CubeAPM, Elasticsearch, and other systems with predictable verbs and JSON output.

Database safety is enforced at independent layers:

1. Read-only database roles
2. Read-only session configuration
3. Agent approval friction for high-risk clients

No single configuration mistake is expected to carry the entire safety boundary.

The agent assesses alerts, investigates traces and logs, checks metrics, correlates deployments, maps dependencies, and produces a hypothesis with supporting timestamps and evidence. Prior incident reports can remain in the workspace as patterns for later investigations.

The custom CLIs use structured output, discoverable resource/action commands, clean stdout and stderr, and isolated configuration. Those details make the difference between giving an agent a tool and giving it a tool it can use reliably.