Skip to content
oto
Menu
Overview
IntroductionConceptsArchitectureContributingReleasing
Design
oto — System Design ProposalDomain Research: Prometheus Alertmanager + Slackoto — Red-Team Memooto — SCOPE BOUNDARY (the doctrine)oto — BINDING SPECIFICATION v1
ADRs
0001 — PostgreSQL is the sole datastore; River is the job queue0002 — `internal/<domain>/{api,service,repository,domain}` with three model sets0003 — Alert, AlertOccurrence and AlertEvent are three distinct entities0004 — oto owns alert identity; Alertmanager's fingerprint is recomputed, not trusted0005 — A durable group key, and the AlertGroup generation owns the Slack thread0006 — The Alertmanager API v2 reconciler is mandatory, not optional0007 — Webhook response contract: 202 or 503. Never 4xx, never 429.0008 — Slack: `chat.update` in place is primary; threads are secondary; one colour attachment0009 — Rule definitions are snapshotted and versioned at fire time0010 — Server-Sent Events with durable resume, not WebSocket0011 — Validation is seven layers with two opposite trust models0012 — Pastel product chrome, saturated colour reserved exclusively for state0013 — oto is alert-first: the Flight Recorder Test defines the scope boundary0014 — Postgres is the only store; no TSDB or column store in v10015 — No stream processor; River in Postgres is the pipeline0016 — Cluster context arrives via MCP, on demand; never the Kubernetes event firehose0017 — Alertmanager-style matchers, not CEL; and a filter AST that keeps the door open0018 — Slack distribution: a customer-built internal app, credentials in config0019 — MIT licence0020 — Broadcast the transitions that must be seen0021 — Correctness and testing strategy0022 — Length-prefixed identity pre-images0023 — Terminal thread states are decided first, and the send is three phases0024 — Retention defaults, what each boundary destroys, and cold storage0025 — The alert list resolves rule snapshots in a batch, not per row0026 — `refire_grace` and the flap thresholds, derived from a real rule corpus0027 — Delivery drills: a synthetic alert through the real pipeline, and the mark that keeps it out of the numbers0028 — Non-urgency motion: one-shot events, honest activity loops, and nothing else0029 — Type and radius scales, read off the product rather than drawn for it0030 — Tier A repainted as Washi & Ink / Konshi Sutra; accent moves to beni0031 — Sharp corners and higher-contrast grid lines within Washi & Ink; colours unchanged0032 — Dark-theme accent moves from beni to plum-blossom blue-and-white; light untouched0033 — The alert filters are a toolbar above the table, not a panel in the rail0034 — Notifications is a destination, and the record it keeps is readable0035 — Decorative ink as a masked wash: one primitive, four motifs, and the placements it is refused0036 — AlertOccurrence becomes AlertCase, and `case` is argued against FR-1 by name0037 — A Wording is Liquid, and the structure around it stays oto's0038 — The group key is derived from the alert's own labels0039 — Group close stays activity-driven0040 — A Case is `open` or `closed`, and it is never reopened0041 — The Alert/Case allocation, and the one rule that decides it0042 — Storm damping is removed, because the defence was built before its object0043 — The Slack action row renders five elements, and the fifth is the snooze pair0044 — A count condition is a silence the operator asked for, and `below_threshold` is how oto says so0045 — A Case is a conversation, and one Slack thread per alert is the accepted cost0046 — Corners round again: ADR 0031's radius override is reversed0047 — A channel answers to a connection, and Slack gets two scopes back0048 — A Wording is spelled by its channel, and the marks in between are oto's0049 — A Wording is selected by its own clause, not by a route0050 — A NotificationTemplate is one whole message, and its policy says which one0051 — A `raw` template owns the whole message, and a template may carry its replies0052 — An Incident is drawn over Cases, and its response is handed off0053 — An Investigator reads, proposes, and never decides delivery0054 — A Remedy earns the write path0055 — An incident-tool integration is data or a bridge, never code inside oto0056 — A Case the upstream stopped speaking about expires, and says why
Setup
Configuration referenceReaching an incident tool: the envelope, a mapping, or a bridgeInvestigatorsRemediesConnecting oto to SlackThe live Slack verification runTuning otoConnecting oto to VictoriaMetrics (vmalert)The generic webhook and `oto.notification.v1`
Runbooks
oto runbooksAlert search — optional partial/substring matching on alert namesoto_clock_skew_secondsoto_delivery_claim_lost_totaloto_ingest_accepted_totaloto_ingest_alerts_totaloto_ingest_duplicate_totaloto_ingest_duration_secondsoto_ingest_fingerprint_mismatch_totaloto_ingest_process_duration_secondsoto_ingest_rejected_totaloto_ingest_shed_totaloto_job_duration_secondsoto_job_queue_depthoto_jobs_dead_totaloto_jobs_enqueued_totaloto_jobs_failed_totaloto_jobs_panics_totaloto_jobs_snoozed_totaloto_jobs_started_totaloto_jobs_succeeded_totaloto_jobs_unknown_version_totaloto_render_invalid_totaloto_slack_unknown_action_totaloto_stream_connectionsoto_stream_events_coalesced_totaloto_stream_events_dropped_totaloto_stream_events_fetched_totaloto_stream_events_published_totaloto_stream_fetch_errors_totaloto_stream_listener_reconnects_totaloto_stream_notify_malformed_totaloto_stream_notify_received_totaloto_stream_poll_recovered_totaloto_stream_resync_totaloto_thread_gap_recovered_totaloto_thread_head_wait_secondsoto_thread_order_decisions_total

0019 — MIT licence

Status: Accepted · 2026-08-08 Resolves: red-team memo §7, open decision 4 — “What is the licence, exactly?” Artefact: LICENSE (MIT, committed)

Context

Section titled “Context”

oto is self-hosted software that runs inside a customer’s cluster and reads their alerting stack. The buyer is a platform engineer, the install is approved by someone’s legal or security function, and the first question that function asks is what the licence obliges them to do.

The competitive field is permissive, and the earlier assumption that it was not turned out to be wrong:

  • Keep’s core is MIT, with a proprietary ee/ directory holding AIOps correlation, RBAC, SSO and HA.
  • Robusta OSS is MIT. Its web UI is not open source at all — self-hosting it requires an enterprise plan — but the OSS core carries no copyleft obligation.
  • Grafana OnCall OSS was AGPLv3. It entered maintenance mode on 2025-03-11 and was archived on 2026-03-24, with Cloud Connection and its APIs switched off. Grafana’s replacement is a hosted paid product.

The last point is the one that matters most, and not for the reason it first appears. The archived AGPL project is the vacuum oto is aimed at (ADR 0013’s context; memo §1). Its users are, right now, looking for somewhere to go. Asking them to move from one AGPL project to another AGPL project offers them nothing they did not already have, while asking them to re-run the legal review they ran years ago.

Copyleft’s actual protection is against a hyperscaler taking the code and offering it as a managed service. That risk is essentially zero for a project with no users, and becomes non-zero only after success. Its cost, by contrast, is paid immediately and by exactly the population oto needs first: corporate self-hosters whose legal teams have a standing position on AGPL. The protection is deferred and speculative; the friction is immediate and certain.

The licence decision is also close to irreversible. Once outside contributors exist, relicensing requires every one of their consents.

Decision

Section titled “Decision”

oto is MIT-licensed. LICENSE is committed at the repository root.

This is the whole decision. There is no ee/ directory, no proprietary module, no feature behind a licence key, and no CLA. If a commercial layer is ever added, three things bind it, recorded here so that a later decision inherits them rather than re-deciding them:

  1. The open-core line, if drawn at all, falls on organisational scale — SSO, RBAC, multi-cluster fleet management, audit export. Never on correctness or safety. Rate limiting, deduplication, storm damping, flap damping, delivery reliability, retention controls and redaction are never paywalled. Paywalling safety is how open-core products lose the community that made them worth buying.
  2. The self-hosted product is never degraded to sell a hosted one. Self-hosted-first is the commercial position and the moral one; this category’s buyers are structurally sceptical of shipping cluster telemetry to a third party.
  3. No code is copied from Keep or Robusta. MIT permits reuse with attribution, but a project in this space silently vendoring a competitor’s code is both a licence breach and a reputational failure. Read for ideas, write the code.

MIT rather than Apache-2.0 is a deliberately small choice. Both are permissive and either would serve. MIT is shorter, is what a reader of this repository’s peers already expects, and matches the licence the two live competitors chose — which removes the licence as a topic of conversation entirely. Apache-2.0’s one substantive addition is its express patent grant. oto holds no patents and the project is not of a size where that clause changes anyone’s decision. If that ever stops being true, moving from MIT to Apache-2.0 is a far easier conversation than moving away from copyleft would be.

Consequences

Section titled “Consequences”
  • Anyone may run, fork, modify, embed or sell oto, including as a hosted service, without sharing changes back. This is accepted, not merely tolerated.
  • Contributions arrive under MIT with no CLA, which means the project cannot unilaterally relicense later. That is a real constraint and it is the point: it is what makes the permissive promise credible rather than provisional.
  • Legal review at a corporate self-hoster is a formality, which is the intended effect. The install decision should be about whether the product is good.
  • Migrating from archived Grafana OnCall does not require a licence conversation. Given that population is the primary near-term audience, this is the largest practical consequence of the decision.
  • oto forfeits the protection copyleft would have given against a cloud provider hosting it. If that becomes a live threat, the response will have to be product and trademark, not licence — the licence will no longer be movable.
  • The competitive field is now uniform on licence, so oto cannot differentiate on openness. It has to differentiate on the product. Correct.

Alternatives rejected

Section titled “Alternatives rejected”

AGPL-3.0. Rejected. It buys protection against a risk that is zero today and pays for it in adoption friction today, from precisely the corporate self-hosters oto needs first. It would also make oto the most restrictive option in a field where both live competitors are MIT-cored — a strictly worse position than either of them on a dimension the buyer actually checks. And it is the licence of the archived project whose users oto is courting, which makes it the one licence with a specific reason not to choose it.

Apache-2.0. A genuinely reasonable alternative and the closest call. Rejected only on the grounds above: no patent portfolio makes the patent grant material, and MIT matches the field’s convention. This is a preference, not an argument, and it is recorded as such.

BSL / Elastic-style source-available. Rejected. It buys the same protection as AGPL while forfeiting the “open source” label and the goodwill attached to it. For a product whose entire pitch is “self-hosted, yours, no third party in the trust path”, shipping under a licence that is not open source undercuts the pitch at the point of sale.

Open-core from the start (permissive core plus a proprietary ee/) — what both live competitors actually do. Rejected for v1 as premature, not as wrong. Open-core is a decision about which customers pay, and there are no customers. Drawing that line before anyone has used the product would draw it in the wrong place, and the constraints recorded in the Decision above are the guardrails for drawing it later.

No licence at all (source published, rights unstated). Rejected. Unlicensed published source is legally unusable by exactly the audience oto is for, and reads as carelessness.