Engineering & Infrastructure Templates
Two templates for the technical organisation: the software delivery lifecycle and cloud cost operations.
create-leafmesh my-project --template engineering-sdlc # or:
create-leafmesh my-project --template infra-cost-opsengineering-sdlc — Ticket → Merge
14 agents · 2 crons
| Agent | Type | Role |
|---|---|---|
spec_agent | LLM | Ticket → testable spec + risk assessment; high-risk or public-API work forces architect review |
junior_engineer_agent | LLM | Implements the spec; opens a draft PR |
test_engineer_agent | LLM | Writes and runs tests (parallel with security) |
security_scanner_agent | Programmatic | Vulnerability + dependency scan on every build |
code_reviewer_agent | LLM | Fan-in over build + test + security; kicks back or approves; HIGH security findings hard-block |
regression_detector_agent | Programmatic | Test flips and flakes from CI history; flips block merges |
refactor_agent | LLM | Weekly tech-debt pass |
oncall_alert_triager_agent | LLM | PagerDuty/Datadog/Sentry alerts → classified, right runbook attached |
release_notes_drafter_agent | LLM | Merged PRs → categorised notes, security changes flagged |
regulatory_monitor_agent | LLM | Weekly cron — PCI / HIPAA / FedRAMP / SOC 2 / ISO / CCPA / EU-AI-Act changes mapped to your controls |
senior_engineer / architect / eng_manager | Human | Risk-tiered review: senior for cross-cutting, architect for API/architecture, manager for merge |
eng_audit_logger_agent | External | Immutable log of merges, approvals, halts |
How it works. Spec → build → test and security in parallel → the reviewer fans in and is the only gate to merge approval. Risky specs detour through the architect — whose approval feeds back into the build loop, not past it. Around the core loop: flake detection guards CI trust, on-call triage compresses incident response, and the compliance watcher turns regulatory changes into engineering tickets before audit season.
Value. The routine share of engineering — boilerplate implementation, test writing, first-pass review, release notes — stops consuming senior engineers. They re-enter exactly where their judgment matters: security flags, API changes, architecture. Same team, more merged.
infra-cost-ops — Cloud Spend Tuning
9 agents · 2 crons
| Agent | Type | Role |
|---|---|---|
cost_anomaly_agent | LLM | Cost anomaly engineer — spike / drift / idle / new-resource classification with dollar impact *and* the right-sizing tune proposal, data-tier detection included |
regulatory_monitor_agent | Programmatic | Compliance veto: blocks region or encryption tunes that violate GDPR/DPDP/PIPL residency or PCI/HIPAA/FedRAMP encryption floors |
cost_tuner_agent | Programmatic | Applies approved tunes via cloud APIs |
commitments_agent | LLM | Commitments analyst — weekly cron covering RI/SP utilisation, rebalance opportunities, expiry alerts, and reserved-capacity savings forecasts |
iac_drift_agent | Programmatic | Terraform/Pulumi intent vs actual cloud state |
finops_governance_agent | Programmatic | FinOps governance — tag-compliance ledger plus daily spend by cost centre, month-end forecast, overage alerts |
sre_human / cto_human | Human | SRE on risky tunes and critical drift; CTO on data-tier and major cost decisions |
infra_audit_logger_agent | External | Immutable log of every applied tune |
How it works. The anomaly engineer classifies the cost event and proposes the right-sizing tune in one pass. Safe tunes auto-apply; data-tier changes always go to the SRE; and the compliance veto sits in front of the tuner — a tune that would move EU customer data out of region gets blocked before it's ever proposed to a human. Weekly commitment reviews keep reservation coverage honest; drift detection keeps infrastructure-as-code truthful.
Value. Cloud bills grow by default — idle resources, oversized instances, expired commitments nobody re-bought. The mesh applies the safe majority of savings automatically and routes the risky remainder with full context. The compliance veto means cost optimisation can never become a residency violation.