Cloud Steward

Inspiration

Small teams can run cloud commands, but incidents still go wrong when ownership, dependencies, prior decisions, approval, and rollback are missing from the action path. Cloud Steward makes governed context part of every infrastructure decision.

What it does

Cloud Steward collects governed metadata, creates a schema-constrained ActionPlan with Gemini or a disclosed deterministic fallback, and explains every target, reason, expected result, verification, rollback, risk, and mutation status. It persists context, plans, and named approval receipts in CockroachDB or SQLite, and recalls related decisions through a CockroachDB VECTOR(8) cosine index. Approval records intent only: the application exposes no infrastructure execution endpoint.

Live DataHub MCP integration

On August 3, 2026, we verified a local integration with DataHub Core v1.5.0.6, the official showcase-ecommerce datapack, and the open-source DataHub MCP server. Cloud Steward discovers and invokes the read-only search, get_entities, and get_lineage tools before planning. The captured orders workflow includes named ownership, glossary terms, structured governance properties, health, and real one-hop upstream and downstream lineage.

The credential-scanned snapshot and SHA-256 sidecar are public at https://github.com/Layerrail/cloud-steward/tree/main/docs/evidence. The 104-second walkthrough is at https://youtu.be/xW0RnBrROeA. The public Render deployment remains transparently configured for sample DataHub context, deterministic planning, and local memory; the video and evidence show the separate live local DataHub path.

Native Arm64 Cloud AI optimization

For Arm Track 2 — Cloud AI, Cloud Steward now runs its structured planning step locally through CPU-only llama.cpp, keeping governed context on the Arm host. The new path uses Qwen2.5-0.5B-Instruct, a strict JSON schema, deterministic sampling, bounded context, and the same approval-first guardrails as the remote planner. A one-shot llama-completion path avoids chat-template role markers in the JSON grammar.

Native run 30822464850 completed successfully on a cloud-hosted four-vCPU Arm Neoverse-N2 runner. With four threads and five repetitions:

FP16: 160.210 prompt tok/s, 62.575 generation tok/s, 1307.8 MiB peak RSS.
Q4_0: 359.043 prompt tok/s, 121.107 generation tok/s, 602.2 MiB peak RSS.
Q4_0 plus verified KleidiAI: 358.337 prompt tok/s, 120.241 generation tok/s, 596.4 MiB peak RSS.

Against FP16, the Q4_0 plus KleidiAI path reduced model size by 66.46% and peak RSS by 54.39%, with 2.237x prompt and 1.922x generation throughput. Both FP16 and Q4_0 generated real Cloud Steward plans that passed identical structural gates for explicit dry-run disclosure, approval, verification, rollback, mutation-risk escalation, and proposal-only status.

The runtime selected the KleidiAI I8MM Q4 kernel and allocated a CPU_KLEIDIAI model buffer. Against regular Q4_0, however, it measured 0.998x prompt and 0.993x generation throughput. We report that negative result directly: quantization delivered the material optimization; this runner did not show an extra KleidiAI speedup.

Reproduction steps, pinned revisions, model checksums, raw artifact digests, normalized JSON, and disclosures are public at https://github.com/Layerrail/cloud-steward/blob/main/docs/evidence/arm-inference-benchmark.md. The public Render demo remains x86_64 with local Arm inference disabled.

This is useful beyond a benchmark: it is a reusable, safety-gated local planner integrated into an agentic application, with a native Arm workflow that other developers can rerun and audit.

How we built it

The application uses Python 3.12+, FastAPI, Pydantic, SQLAlchemy, the Google Gen AI SDK, CockroachDB, MCP, and dependency-light HTML, CSS, and JavaScript. The DataHub adapter treats returned metadata as untrusted evidence, normalizes search, hydrates governance for the top resource, and probes ranked datasets for one-hop lineage while keeping mutation, user, and document tools disabled. CI covers Python 3.12 and 3.13, native Arm64, CockroachDB vector memory, and live Gemini structured output.

Safety model

Context is gathered before planning. Dry-run is the default. Mutation proposals are elevated to high risk or above. Every plan requires a named approval, but approval cannot execute infrastructure. Degraded integrations are displayed rather than hidden, and the status API returns modes without secret values.

Challenges we ran into

DataHub bootstrap and its official showcase datapack exposed several practical integration issues: interrupted container layers, a full Docker data disk, a Windows drive prefix parsed as a URL scheme, MCP result envelopes, governance spread across glossary and structured-property fields, and lineage that was not always attached to the first search result. We repaired only regenerable local state, added a Windows-aware official datapack wrapper, unwrapped MCP results, mapped governance fields, and added multi-candidate lineage fallback.

Accomplishments that we are proud of

The result is a reproducible, credential-scanned proof using real DataHub Core data and all three required read-only MCP tools. It produces actionable owner and impact context without pretending that approval equals execution. The project is new work begun August 2, 2026 and is licensed under Apache-2.0.

What we learned

Agent quality depends as much on governed context and explicit boundaries as model capability. Ownership, glossary, health, structured properties, and lineage need to survive normalization so operators can inspect the evidence behind a proposed action. Public demo configuration must also be distinguished clearly from isolated live-integration evidence.

What is next

Next we will add a production DataHub Cloud connector, richer impact scoring, signed and expiring approval receipts, policy checks, and an external executor interface that remains separately authorized and auditable.

Try it

Public demo: https://cloud-steward.onrender.com

Source and setup: https://github.com/Layerrail/cloud-steward

Live DataHub evidence: https://github.com/Layerrail/cloud-steward/tree/main/docs/evidence

Walkthrough: https://youtu.be/xW0RnBrROeA