Converge
Install once. Operate for years.

The operational control plane for customer-managed clouds

Converge turns years of expert operational knowledge into product: one platform through which customers, partners, and SREs provision, upgrade, secure, troubleshoot, and retire environments across Azure, AWS, on-prem, and fully air-gapped networks — without a vendor on the call.

1 → 10,000+environments, no redesign
1 binaryCLI · web · API · MCP — air-gap ready
0 SSHdeclare, converge, verify — never patch by hand
Design principles

Hope is not a strategy. Manual operation is technical debt.

Every operational activity becomes deterministic, repeatable, observable, auditable, and automatable.

Declarative first

You declare desired outcomes; the platform plans, executes, verifies, and reconciles. Every operation is idempotent — run it twice, converge to the same state.

Workflows, not scripts

Every operation is a typed workflow DAG of atomic operators — resumable, journaled, formally verified step semantics (Check → Run → Verify → Recover).

API first

UI, CLI, REST, GitOps, and the agent tool surface consume the same APIs. No UI-exclusive functionality — and no CLI-exclusive functionality either.

Zero trust, audited

Every action authenticated, authorized, and written to the audit trail before it executes. Destructive operations are plan-then-confirm by construction.

Air-gap native

A single static binary with embedded UI. No capability assumes outbound internet — fleet features degrade to signed export/import bundles.

Failure-oriented

Network failures, partial failures, human mistakes, and timeouts are assumed. Failed operations halt cleanly, attach a support bundle, and offer rollback.

Architecture

One engine, every surface, any cloud

A modular-monolith control plane: every surface drives the same workflow engine over the same resource model — and the whole thing ships as one binary.

Surfaces Web consoleVue 3 · embedded CLIcf · 39 commands REST + SSE/api · JSON Agent surfaceMCP · 8 typed tools GitOpsdeclarative config Engine Workflow engineoperators + YAML DAGwhen: · needs: · retry: Step kernelCheck · Run · Verify · Recoverjournal · resume · TLA+ verified Approval enginecheckpoints · plan hashessingle-use tokens Policy & preflightgates before executioncompat matrix Services Inventoryfleet resource model Releasesigned manifests Configurationversioned · diffable Auditwrite-ahead trail Diagnosticssupport bundles Controllers Infrastructure Cluster Certificates Registry Backup Monitoring Drift & Reconcile Providers Azure AWS Existing Kubernetes On-prem Air-gapped bundle Terraform · Helm
The reconciliation loop

Desired state, continuously converged

Desired state Plan Execute Verify Observe Reconcile drift detected → plan again
AI-native by design

Agents operate through typed tools, never shells

Converge exposes a governed agent surface: eight typed tools over the same engine every other surface uses. An agent can plan a deployment, interview for missing parameters, and diagnose failures — but applying a plan requires a content-hashed plan_id and a single-use approval token. The agent proposes; the platform constrains.

Plan integrity
plan_id = hash(workspace, config, bundle digest) — apply refuses if inputs drift
Approval
HMAC token over (plan, caller, expiry) · single-use · a bare --yes never qualifies
Boundary
Agent surface runs inside the customer boundary — vendor never holds cloud credentials
Egress
Diagnostics stay local; export is opt-in, redacted, and previewed
See the Copilot
Capabilities

Everything an environment needs, for its entire life

Installation is one small capability. The platform covers the other ten years.

User journeys

The moments that used to be support calls

01 Partner engineer

Run an upgrade — alone

Pick the target release, watch preflight and the compat matrix clear, approve the point of no return, and let verification decide. Failure? Automatic rollback and a support bundle — no vendor on the call.

02 Platform SRE

Answer "what exists?" instantly

Fleet view shows every environment, its version, health, and drift — including air-gapped sites via signed bundle sync. Bulk-plan an upgrade wave across a region in one action.

03 Support engineer

Diagnose without hand-collection

Every failed operation already has its bundle: logs, events, Helm values, versions, journal, masked secrets. Root cause starts at minute zero, not hour two.

04 Compliance officer

Prove who changed what

The audit trail is written before anything executes. Deletion sets, approvals, plan hashes — every operation traceable, attributable, and exportable as evidence.

See it as your operators will

The console below is a working prototype with realistic fleet data — every screen is a journey your team runs today by hand.

Open the console