Deploy in your environment.
The runner, connectors, and models execute in your VPC or air-gapped.
Lightfoot ships l1spec and the compiler. We do not proxy
your tokens. We do not host a multi-tenant incident database. Runner
access is design-partner — there is no public installer.
Your account is the floor
Gates target your PagerDuty, Jira, ServiceNow, GitLab, GitHub,
Datadog, or New Relic. A Lightfoot-hosted desk is invalid. Validate
the graph in your CI: l1ctl validate rejects
phoneHome: true, wildcards, AWS_DENY reads,
env interpolation, and swarm routing.
IAM from the spec
Each node assumes a role generated from the same envelope as the
in-process allowlist. Drift fails CI. Use a real AWS account —
LocalStack will not prove AssumeRole plus ExternalId.
Sessions are short-lived and describe-only.
Connectors you point
One credential per process, at endpoints you operate. Propose-only: notes, comments, draft MRs. A gatekeeper applies those writes from a fixed dispatch table. It never executes model text.
The model you run
Residency is customer-bedrock,
customer-anthropic, customer-ollama, or
customer-litellm. Bedrock in your account, Anthropic
with your key, Ollama on your LAN, or LiteLLM you operate.
Lightfoot does not host the weights.
l1ctl validate graphs/ec2-disk-pressure.l1.yaml