Reliability work you can audit, on a bill you can predict
The engine is Apache-2.0 and runs on your own machine. The subscription is priced per monitoring source, every store is created in the EU, and this deployment publishes the SLOs it grades itself against.
Pages per week is a number you can already get. How many of those pages were avoidable is not, and it is the one that decides whether more headcount is the answer or the symptom.
What happens to our production data
A monitoring vendor that ingests your metrics is a new place your production data lives, a new sub-processor on the register, and a new page in every enterprise security questionnaire.
What happens if we stop paying
A reliability tool you cannot run without a subscription becomes a dependency inside the incident path. That is a trade worth making deliberately, if at all.
Four answers, each one checkable
Apache-2.0 core, offline by default
The CLI and the deterministic replay engine are open source and run entirely on your own machine. A replay you never submit never leaves your network.
The engine in the repository is the engine the paid product runs. Stopping the subscription costs you shadow-mode, the PR gate and the private corpus — not the ability to replay.
Every persistent store is created in the EU jurisdiction. Sub-processors, retention periods and data-subject rights are in one document your legal team can read before the pilot.
It is a property of how the infrastructure is provisioned rather than a policy statement, and it is verifiable on the storage itself.
Every incident, and the rule that should have caught it
The replay grades your rules against the incidents that really happened in the window. Each miss keeps its evidence — which incident, and the reason the alert stayed silent.
An example replay report: five incidents over seven days, two of them missed by CheckoutErrorBudgetBurnFast, each miss listed with the incident it was attributed from.
2 of these 5 incidents burned budget without paging anyone. Every one keeps the rule it was graded against.
Prescriptive
A catalogue of failures, each with the rule change that ends it
Every classified miss resolves to a signature in the public corpus: the root cause in one paragraph, and the diff that fixes it. Readable without an account, indexed for search.
The public failure-signature corpus: three catalogued entries, each with its root-cause class, its identifier and the vendors it applies to.
burnratesurgeon.com/corpus
26 public entries · no account needed
Window boundary miss
sig_synth_checkout_burst_between_evaluations
A 90-second wave of 503s from the checkout service burned 4% of the monthly error budget, but the page never fired: the burst sat between two evaluations of the 1h long window and was averaged away before the rule next ran.
A single node stayed NotReady for three hours after a kernel upgrade. Because the inhibition rule matched only on `cluster`, that one node alert suppressed every burn-rate page in the cluster, including a real recommendations outage on healthy nodes.
Applies to: Prometheus
Cardinality explosion hides the signal
sig_synth_tenant_label_explodes_ratio_series
The burn-rate rule kept the `tenant` label, so onboarding a batch of trial accounts multiplied the recorded series by forty. The rule group hit the per-user series limit, the recording rule was refused, and the alert evaluated against a series that had stopped updating.
Applies to: Mimir, Grafana Cloud
Live
The number that says the fix held
Shadow-mode keeps replaying after the rule ships, so the dashboard is a measurement and not a launch claim. One figure: critical alerts your rules predicted correctly, week by week.
An example north-star dashboard: critical alerts correctly predicted per week over eight weeks, above the counters for the last thirty days.
burnratesurgeon.com/dashboard/checkout-slo
Critical alerts correctly predicted
17
Week of 2026-08-24 · 65 alerts over 8 weeks
24
Replays run
19 graded against alert history
41
Predicted correctly
Alerts the rules raised that really fired
2
Rules about to fail
Alerts that fired and the rules would have missed
6
Storms predicted
Alerts the rules would have raised and reality did not
CheckoutErrorB…
PaymentsLatenc…
5%
Alert burn
△Warning
2 of 43 paging-worthy incidents went unpaged in the last 30 days.
Last 30 days
Is this not something a senior SRE should just do?
It is — and doing it once means a deterministic replay of seven days of your own time series against every rule. This does that on every rule change and keeps the results comparable between them, which is the part a person cannot repeat by hand.
Validate your burn-rate rules against real history. The open-source CLI is free forever — the SaaS adds shadow-mode, PR gates, and a cross-vendor failure-signature corpus.