AI Control Plane

AI Control Plane is a host-first Docker reference implementation for enterprise AI governance: a minimal LiteLLM + PostgreSQL runtime wrapped in typed operator workflows, truthful runtime gates, security validation, and evidence-producing delivery artifacts.

Status: reference implementation, not a managed production service. The support source of truth is docs/support-matrix.yaml, rendered for readers in docs/reference/support-matrix.md; the summary below is a convenience view.

What you are seeing: local AI traffic flows through a LiteLLM gateway with policy controls, telemetry, detection hooks, and evidence-producing operator workflows.

Why this repo exists

Most LiteLLM-based projects stop at “the gateway runs.” This repository goes further:

• typed operator workflows via acpctl
• explicit support and claim boundaries
• deterministic validation and smoke gates
• local readiness evidence and release bundles
• buyer-safe documentation for pilots, procurement, and shared responsibility

The canonical execution roadmap for outstanding work lives in docs/ROADMAP.md.

Support Boundary

Status	Boundary
Validated now	Host-first Docker reference implementation, typed operator workflows, scheduled backup and restore verification, typed upgrade framework, readiness evidence, pilot closeout artifacts, and customer-operated active-passive HA failover drill evidence surface
Conditionally ready	Customer pilots on controlled Linux hosts with customer-owned network, IAM, SIEM, retention, and workspace controls validated
Incubating	AWS-first cloud deployment package with explicit IaC fmt, validate, validation-only plan workflows, AWS hardening guidance, and a basic cost-estimation model; design-only tenant isolation/billing package
Not yet validated	Azure/GCP applied/runtime cloud deployment claims, AWS applied/runtime cloud-operation evidence beyond the explicit validation package, shared-runtime multi-tenant managed-service claims, and universal browser-bypass prevention

• Supported runtime: host-first Docker baseline plus explicit overlays
• Supported host boundary: Debian 12+ or Ubuntu 24.04+ with systemd, apt, Docker, Docker Compose, and verified SSH host keys
• Primary operator UX: make
• Typed workflow UX: ./scripts/acpctl.sh
• Incubating only: deployment-exploration assets under deploy/incubating/

Quick Start

Fastest useful reviewer flow:

make install
make up-offline
make health
./scripts/acpctl.sh status
./scripts/acpctl.sh doctor

Standard connected baseline:

make install
make up
make health
make operator-report
make operator-dashboard
make prod-smoke

Validate tracked config before changing deployment surfaces:

make validate-config
make validate-config-production SECRETS_ENV_FILE=/etc/ai-control-plane/secrets.env
make validate-tenant

Operator Paths

• Local baseline: make up
• Managed UI overlay: make up-ui
• DLP overlay: make up-dlp
• Offline deterministic runtime: make up-offline
• TLS ingress overlay: make up-tls
• Day-2 reporting and recovery: make operator-report, make operator-dashboard, make chargeback-report, make db-backup, make db-backup-retention, make dr-drill, make ha-failover-drill, make validate-policy-rules, make policy-eval, make assessor-packet
• Certificate lifecycle: make cert-status, make cert-renew, sudo make cert-renew-install SECRETS_ENV_FILE=/etc/ai-control-plane/secrets.env
• Host-first upgrade lifecycle: make upgrade-plan FROM_VERSION=X.Y.Z, make upgrade-check FROM_VERSION=X.Y.Z, make upgrade-execute FROM_VERSION=X.Y.Z, make upgrade-rollback UPGRADE_RUN_DIR=...
• Key lifecycle: make key-list, make key-inspect ALIAS=<alias>, make key-rotate ALIAS=<alias>
• Guided diagnostics and remediation: make doctor FIX=1 NOTIFY=1
• Production-like host path with baseline host hardening: docs/DEPLOYMENT.md

Repo Map

Path	Purpose
demo/	Runnable local runtime and fixtures
examples/	Curated operator examples and sanitized pilot artifacts
cmd/acpctl/	Typed CLI surface
internal/	Typed implementation packages
deploy/	Supported host deployment assets plus incubating tracks
docs/	Canonical public docs, references, and architecture material

Start Here

• Documentation index
• Deployment guide
• Observability signal reference
• OTEL collector setup
• Vendor evidence ingest
• ACP custom policy engine
• HA and failover topology
• Active-passive HA failover runbook
• Compliance crosswalk
• Security whitepaper and threat model
• CVE remediation and risk acceptance policy
• Performance benchmarks and sizing guidance
• Security and governance
• Technical architecture
• Examples
• Support matrix
• Roadmap
• Changelog
• Release notes convention

Release Discipline

• Current tracked version: VERSION
• Changes over time: CHANGELOG.md
• Release-note convention: RELEASE_NOTES.md
• Generated release artifacts: make release-bundle, make readiness-evidence, make assessor-packet, make pilot-closeout-bundle

Canonical Docs

• Roadmap
• Compliance Crosswalk
• Security Whitepaper and Threat Model
• External Review Readiness
• CVE Remediation and Risk Acceptance Policy
• Performance Benchmarks and Sizing Guidance
• Pilot Closeout Kit
• Support
• Architecture
• Operations And Deployment
• HA And Failover Topology
• Active-Passive HA Failover Runbook
• Certificate Lifecycle
• Upgrade And Migration
• Security And Governance

Generated references:

• ACPCTL Reference
• Approved Models
• Detection Rules
• Support Matrix

Local Env Files

• demo/.env is local-demo only.
• /etc/ai-control-plane/secrets.env is the canonical host-production env source.
• Production workflows do not sync secrets back into the repository tree.

License

AI Control Plane is licensed under Apache-2.0.

• Project notice: NOTICE
• Third-party license boundary: docs/policy/THIRD_PARTY_LICENSE_MATRIX.md
• Customer-facing compliance summary: docs/deployment/THIRD_PARTY_LICENSE_SUMMARY.md