// cat ./projects/specterheal.md

RESEARCH · 2024

SpecterHeal

AI-Assisted Self-Healing Infrastructure

An autonomous remediation orchestrator pairing Lynis auditing with Ollama-driven reasoning, executing dynamic Ansible playbooks against drifted hosts under human approval gates.

LynisOllamaAnsibleStreamlitPython

## Problem

Hardening reports rot the moment they're filed. Drift accumulates between audits, and engineers spend their cycles re-applying the same fixes across fleets.

## Architecture

Lynis audits each host on a schedule. Findings are passed to a local Ollama model that classifies severity and proposes remediation steps. Those steps are templated into Ansible playbooks and executed against the target with full audit logging.

## Human-in-the-Loop

A Streamlit dashboard surfaces fleet-wide posture, queued remediations, and AI confidence per finding. Operators approve high-impact changes; low-risk drift heals itself. Every action is reversible via generated rollback plays.

## Lessons Learned

Marketing this as 'AI fixes servers' was the wrong frame. Reframing it as 'AI-assisted remediation orchestration' kept operators in control and made the platform actually shippable.

## Roadmap

Pluggable scanners beyond Lynis (Wazuh, OpenSCAP), confidence calibration on remediation outcomes, and a policy DSL for per-host auto-approve thresholds.