Every incident flows through the same seven phases. Most of the pipeline is deterministic procedure — the AI models are called only where a decision is genuinely ambiguous. Here is one incident followed end to end.
Determines which service actually emitted the error. Deterministic pre-gates run first — an exact stack-trace file:line match, or a plain-English symptom matched against the indexed codebase — and only fall through to the model when the signal is genuinely ambiguous.
Walks the service dependency graph outward from the emitter (breadth-first) to list every upstream and downstream service that could plausibly be involved. This bounds the investigation to what matters.
For every service in scope, four collectors run concurrently: infrastructure state (pod phase, restarts, OOM), L7 health (endpoints, error rate, latency), authentication signals (401/403, cert expiry), and recent deployment state. Pure data gathering — no interpretation yet.
A deterministic set of thresholds turns the collected signals into a verdict: is this an infrastructure suspect, or does the fault live in the product layer? This fork decides which analysis path runs next.
Retrieves the relevant log window (anchored to the incident timestamp) and runs it through log analysis and path traversal in parallel. Relevant excerpts from your indexed codebase and runbooks are pulled in so the model reasons about your system, not a generic one.
fatal: runtime: out of memory repeating at the container memory ceiling. Confirms the OOM is the origin, not a symptom.
Runs only when earlier phases surfaced a database signal — a query plan, connection-pool exhaustion, or a schema/constraint anomaly. When there is nothing database-related to check, this phase is skipped entirely.
Synthesizes every finding into a single operational action, scored for confidence. Deterministic guardrails then check the result: destructive steps are marked unsafe, and if confidence falls below the threshold the output is INCONCLUSIVE rather than a guess.
Assigns the incident an L1 category (one of seven fixed operational classes) and an open L2 sub-category, so incidents can be tracked and trended over time.
What if the evidence had been thinner? If the signals had pointed in more than one direction, or the confidence had landed below the threshold, P6 would have returned INCONCLUSIVE — with the evidence it did collect and the reason it stopped short — rather than a workaround it couldn't stand behind.