Ingest alert
Keep incident window and service boundary explicit.
Context TriageQuality Engineering Demo
Cross-System Incident Diagnosis Agent
An incident agent that gathers logs, metrics, deployment and config evidence, then converges through falsifiable hypotheses.
Structure Blueprint
Clickable pattern simulator
Interactive Browser Demo
This simulator does not replace the CLI run, but it makes each step, state, log, gate and final output visible in the browser.
Live pipeline
State inspector
Execution log
Current output
Step-by-step Design
Fan out queries
Read logs, metrics, deploy events and config in parallel.
Fan-out/GatherFuse evidence
Normalize heterogeneous evidence into one timeline.
Multi-Modal FusionForm hypothesis
Generate the likely root cause and a test.
Iterative HypothesisFalsify/refine
Reject weak hypotheses and converge on evidence.
Iterative HypothesisPublish report
Return timeline, confidence, next action and unresolved risk.
Observability HarnessScreenshots
Pattern Mapping
| Pattern | Design role |
|---|---|
| Fan-out/Gather | Incident evidence lives in multiple systems and can be queried in parallel. |
| Multi-Modal Fusion | Logs, metrics and config must become one comparable timeline. |
| Iterative Hypothesis | The agent should test and reject hypotheses, not just narrate symptoms. |
| Observability Harness | Every diagnosis needs trace, confidence and unresolved risk. |
Design Insights
Diagnosis is not search
More logs do not help unless the agent has a hypothesis loop.
Read-only can still be powerful
A diagnostic agent can be safe by producing evidence and next actions without executing fixes.
Confidence is a routing signal
Low confidence should trigger escalation, not a confident-sounding paragraph.
Run Path
cd workshops/workshop3-incident-diagnosis
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python src/main.py
open visual/index.htmlworkshops/workshop3-incident-diagnosis/README.mdimages/training/visual/workshop3-incident-diagnosis-blueprint.png