Companion Local AI Lab¶

Engineering Deep Dive Proof Gallery Skills Matrix

Purpose

The companion local-ai-lab-infra repository provides a local-first AI infrastructure workflow aligned with the O6 policy-mediated operations model. It gives reviewers a runnable way to inspect AI-assisted infrastructure generation, validation, evidence capture, and human approval boundaries before those patterns move into cloud operations.

Repository at a glance¶

Area	Description
Repository	`jrikobd-azaws/local-ai-lab-infra`
Scope	Local AI-assisted infrastructure workflow, validation pipeline, tool access controls, evidence bundles, and human review gates.
Runtime model	Local-first workflow with Ollama/local model support and optional cloud provider routing where configured.
Relationship to O6	A local reference implementation aligned with the AzAWSLab O6 AI Operations Enclave: policy-mediated tool use, controlled execution, validation evidence, and human approval boundaries.
Safety posture	The lab generates, reviews, and validates infrastructure artifacts without auto-applying infrastructure changes.

Operating model¶

The companion lab is built around controlled AI assistance rather than autonomous execution.

User request
   |
   v
Multi-agent workflow
   |
   v
Local generation and planning
   |
   v
Sandbox validation
   - Terraform validation
   - TFLint
   - Checkov
   - Trivy
   - Infracost
   - Ansible syntax checks
   - ansible-lint
   - yamllint
   |
   v
Evidence bundle
   - deterministic reports
   - JSON audit data
   - run index
   - checkpoints
   |
   v
Human review / HITL pause
   |
   v
Optional GitOps-ready output

How to use the project¶

The project includes a runnable usage guide:

docs/how_to_use_project.md

The guide covers:

syncing or cloning the repository;
creating and activating the Python virtual environment;
loading environment configuration;
starting the local services;
verifying Ollama and required models;
building or using the sandbox validation image;
running smoke validation;
reviewing deterministic SecOps and FinOps reports;
inspecting JSON audit bundles and run indexes;
stopping at the human-in-the-loop boundary before GitOps output.

The key operational point is local validation and review. It does not auto-apply infrastructure.

Safety and validation model¶

Safety control	What it validates
No-auto-apply posture	The workflow is designed not to run `terraform apply` or `terraform destroy` automatically.
HITL pause	Generated infrastructure output remains subject to human review before GitOps output or promotion.
Sandbox validation	IaC, security, cost, and syntax checks run before generated output is treated as reviewable.
Deterministic reports	SecOps and FinOps outputs can be inspected consistently between runs.
JSON audit bundles	Runs produce structured evidence for post-execution review.
SQLite run index	Execution metadata is retained for traceability.
LangGraph checkpointing	Workflow state can be persisted and inspected.
Tool access controls	Tool use is validated and constrained instead of receiving broad execution authority.

Core components¶

Component	Implementation role
Orchestrator	Coordinates the local multi-agent workflow and validation path.
Agent roles	Separate planning, generation, security review, cost review, and GitOps formatting.
Local LLM runtime	Supports local model execution through Ollama where configured.
Provider routing	Allows configured provider selection for review or generation tasks.
Sandbox validator	Runs infrastructure, security, cost, and syntax checks before output is treated as reviewable.
Evidence bundle	Captures reports, JSON audit data, run metadata, and validation output.
Human review gate	Keeps generated infrastructure changes under engineer control.

Documentation and evidence routes¶

Use the repository documentation as the review path:

Document or folder	What to inspect
README.md	Project overview, current status, design goals, safety controls, and run model.
docs/how_to_use_project.md	Step-by-step usage workflow and validation commands.
docs/architecture.md	Local lab architecture and component relationships.
docs/project_status.md	Current implementation status and capability notes.
docs/provider_selection.md	Provider routing and model selection context.
docs/open-webui.md	Local UI integration notes where relevant.
docs/awx-artifacts.md	AWX-related generated artifacts and review context.
docs/troubleshooting.md	Operational troubleshooting and run support.
docs/evidence/	Evidence generated by the companion workflow.

Relationship to AzAWSLab O6¶

The companion lab is not a separate, unrelated project. It supports O6 by giving the AI Operations Enclave a local development and validation environment.

O6 concept	Companion lab support
Policy-mediated tool use	Tool access controls and validation keep AI actions bounded by policy.
Human approval boundaries	HITL pause keeps generated changes under engineer review.
Evidence capture	JSON audit bundles, reports, run indexes, and validation output provide reviewable evidence.
Platform safety	No-auto-apply posture prevents generated infrastructure from mutating live environments automatically.
Reproducibility	Local setup and usage guide allow the workflow to be rerun and inspected.

Why this matters¶

AI governance is implemented as a working pattern, not left as a concept.
The project implements local-first AI infrastructure generation with validation, traceability, and review gates.
The design gives technical reviewers a way to inspect how AI-assisted operations stay bounded.
The companion project strengthens O6 by testing the same operational discipline before cloud-side adoption.