LandfallDocs
Get started

What Landfall does and does not do

Landfall is the one war room for an incident, beside the channels and tools you keep. This page says where it stops, so you can decide before you connect anything. Every line describes what ships today, not what is planned.

Changes to your systems

  • Landfall never approves or runs a change. There is no executor and no approve button for one. An agent records a suggestion with what it would touch and how to undo it; a person applies it in their own tools and records in the room that they did.
  • The one approval in the product is the comms gate: a person approves a drafted stakeholder update before it is sent.
  • Writes to other tools happen only where an admin turns them on: incident updates to Slack, Microsoft Teams, Telegram, Buzz and email, and, if enabled, acknowledge, resolve and notes on a linked PagerDuty or Opsgenie alert. Each update is approved by a person.

What is staged, and what is not

With the admission gate on, as it is by default, some of what enters a room waits until the room admits it. The scope is narrower than “everything”, so here it is exactly.

  • Staged: a finding or hypothesis a responder's coding agent shares through the landfall CLI, and a finding a person proposes from the Context tab.
  • Not staged: what Beacon, the room's AI agent, posts; a note or a widget a coding agent shares; ordinary chat.
  • How a staged item is admitted: in an incident room a plain observation is admitted automatically once Landfall has re-checked it against the source. A cause, a correlation or a directive needs a person. The author's own vote never admits an item alone, a coding agent casts no vote on a default install, and a human override always wins.
  • Context the room finds wrong is hidden, never deleted, with the reason on the record, and kept out of what agents reason from.
  • An admin can change the gate's mode under Settings, Governance: Enforcing (the default), Report-only, or Off. Detail: Shared context.

Chat, voice and video

  • Slack, Teams, Telegram and Buzz are outbound only. Landfall posts approved updates out to them. No Slack or Teams message enters the room, and Landfall never reads your workspace's message history.
  • Sending is off for every organization until an admin turns it on. Until then updates are simulated and nothing reaches your workspace.
  • There is no Zoom or Meet integration. The room has its own voice room; recording and transcription are off by default.

Paging and on-call

  • Landfall is not a phone pager. Its own on-call schedules and escalation policies page by Slack message and email. A phone number can be stored, but Landfall does not call it yet, and there is no SMS or push notification.
  • Keep PagerDuty, incident.io or Opsgenie if you have them. A PagerDuty or Opsgenie alert can open a war room, and Landfall reads who is on call from PagerDuty.

Your coding agent

  • The CLI runs on macOS and Linux. Windows is not supported yet.
  • It connects six coding agents: Claude Code, Codex CLI, VS Code, Cursor, Claude Desktop and Windsurf. Any other MCP client can be configured by hand.
  • Your agent joins under your name. Each person creates their own join link; a link you send a teammate would bring their agent in as you.
  • Source code, command output and secrets stay on your machine unless you choose to share them. Anything that names your working directory is held until you release it.

Managers and assistants

  • The manager connector is read only. Nothing asked through it can approve, run or page anything.
  • Claude is the assistant with a live check on record. Another assistant is named here only once its own check is recorded.

Memory

  • The Company second brain learns by itself after each resolved incident, from the findings the room admitted, and never from a demo room. There is no accept step, so nothing it believes was signed off by a person first.
  • Every belief shows its evidence, and an admin can correct or retire one; a retired belief stays readable with the reason.

Your telemetry and keys

  • Reads only. AWS through a read-only role in your own account; other sources through keys you add, which stay in a secrets manager. Agents and widgets read through a proxy that never hands them a key.
  • The Kubernetes and MySQL agents connect out and never need to be reachable. The Kubernetes agent answers read-only questions only for incidents the cluster is part of; the MySQL agent never reads a table row.

Not an AI SRE

Landfall does not race your AI SRE on detection or on the first finding, and it does not remediate. Beacon investigates in the open, names the source behind each finding, and suggests. If you run an AI SRE, it hands responders a first lead; Landfall is the room where they work it out.

Read more