Circuit-Forge/turnstone
5
0
Fork 0
Code Issues 11 Pull requests 1 Projects Releases 6 Packages Wiki Activity Actions

feat: natural language source addition -- describe a log source in plain English #53

New issue
Closed
opened 2026-05-26 23:05:29 -07:00 by pyr0ball · 1 comment
pyr0ball commented 2026-05-26 23:05:29 -07:00
Owner
Copy link

Complement the onboarding wizard with an LLM-powered source addition flow: the operator describes a log source in natural language and Turnstone generates the correct sources.yaml entry and (optionally) a matching pattern set.

Examples of operator input:

  • "nginx access logs on this machine"
  • "Docker container named cf-web running on 10.1.10.71"
  • "SSH journal from my NAS at nas.local"
  • "qBittorrent log at /opt/qbit/logs/qbittorrent.log"

Flow:

  1. Operator types a description in a text field in the Add Source panel
  2. LLM (local-first via cf-orch / Ollama; cloud fallback) interprets the description and emits a structured SourceDefinition JSON
  3. Turnstone resolves the path, tests reachability (SSH connection test, file existence check)
  4. Shows a preview of the YAML entry that will be added
  5. Operator confirms; source is written and initial glean triggered

Design constraints:

  • LLM call is optional -- if no LLM configured, skip to manual form entry
  • LLM output is always validated against the SourceDefinition schema before writing (never write unvalidated LLM output to disk)
  • The generated YAML is shown to the operator before any write -- human approval required

Acceptance criteria:

  • Describing "nginx access log" produces a correct source entry for /var/log/nginx/access.log
  • LLM unavailable: falls back to structured form (no crash, no hang)
  • Invalid LLM output: schema validation error shown, no write performed
Complement the onboarding wizard with an LLM-powered source addition flow: the operator describes a log source in natural language and Turnstone generates the correct `sources.yaml` entry and (optionally) a matching pattern set. **Examples of operator input:** - "nginx access logs on this machine" - "Docker container named cf-web running on 10.1.10.71" - "SSH journal from my NAS at nas.local" - "qBittorrent log at /opt/qbit/logs/qbittorrent.log" **Flow:** 1. Operator types a description in a text field in the Add Source panel 2. LLM (local-first via cf-orch / Ollama; cloud fallback) interprets the description and emits a structured `SourceDefinition` JSON 3. Turnstone resolves the path, tests reachability (SSH connection test, file existence check) 4. Shows a preview of the YAML entry that will be added 5. Operator confirms; source is written and initial glean triggered **Design constraints:** - LLM call is optional -- if no LLM configured, skip to manual form entry - LLM output is always validated against the `SourceDefinition` schema before writing (never write unvalidated LLM output to disk) - The generated YAML is shown to the operator before any write -- human approval required **Acceptance criteria:** - Describing "nginx access log" produces a correct source entry for `/var/log/nginx/access.log` - LLM unavailable: falls back to structured form (no crash, no hang) - Invalid LLM output: schema validation error shown, no write performed
pyr0ball added this to the beta milestone 2026-05-26 23:05:29 -07:00
pyr0ball added the
ux
enhancement
 labels 2026-05-26 23:05:29 -07:00
pyr0ball commented 2026-05-29 09:45:29 -07:00
Author
Owner
Copy link

Implemented. Backend: app/services/discover.py (journald/Docker/file detection), app/services/nl_source.py (keyword+LLM interpretation), GET /api/setup/status + /discover, POST /api/setup/write + /interpret. Frontend: SetupWizard.vue (3-step Detect→Select→Confirm), wired into SourcesView (shows on first run when no sources.yaml; Add Source button reuses it post-setup). NL field with manual form fallback. 372 tests passing, build clean.

Implemented. Backend: app/services/discover.py (journald/Docker/file detection), app/services/nl_source.py (keyword+LLM interpretation), GET /api/setup/status + /discover, POST /api/setup/write + /interpret. Frontend: SetupWizard.vue (3-step Detect→Select→Confirm), wired into SourcesView (shows on first run when no sources.yaml; Add Source button reuses it post-setup). NL field with manual form fallback. 372 tests passing, build clean.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/42-50-postgres-multitenant
feat/32-domain-view
feat/15-hybrid-rag
feat/41-hybrid-bert-shim
feat/60-incidents-db
feat/pipeline-cleanup
feat/29-multi-agent-diagnose
feat/ssh-remote-glean
feat/live-watch
feat/llm-reasoning
feat/frictionless-capture
v0.7.0
v0.6.2
v0.6.1
v0.6.0
v0.5.0
v0.4.0
v0.3.0
v0.2.0
v0.1.0
Labels
Clear labels   
compliance

   
demo

   
deployment

   
docs

   
enhancement

   
parser

   
patterns

   
performance

   
security

   
ux
No labels
compliance
demo
deployment
docs
enhancement
parser
patterns
performance
security
ux
Milestone
Clear milestone
No items
No milestone
beta
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Circuit-Forge/turnstone#53
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?