Investigate
The agent collects logs, traces and metrics for the window and correlates them with deploys and config changes.
Agentic · ships today
Incident root cause,
with a person in charge
An agent collects and correlates the evidence; a person owns the causal claim.
Ships as incident/rca
After an incident, an agentic step gathers logs, traces and metrics, correlates them with recent changes and drafts a narrative. The root cause is only accepted when a person signs it. Single-alert triage (security_triage/triage) follows the same pattern in one step.
The pipeline
Accept the root cause
A gate holds the proposed cause until an engineer accepts or rewrites it.
Draft the post-mortem
A second agentic step drafts the timeline, impact and actions from the accepted cause.
Review and publish
The team edits and publishes. The draft and its evidence stay linked.
What the record keeps
The incident window, the evidence the agent read, the proposed and accepted cause, the draft, and the spend of each agentic step.
Hours to minutes
Evidence gathering and the first draft are done before the meeting.
No invented causes
The agent proposes; an engineer accepts. The gate is not optional.
Narrower questions
incident/blast-radius counts measured errors across the call graph; security_triage/triage proposes a severity and action per alert.
Ships as incident/rca, incident/post-incident-postmortem, incident/blast-radius and security_triage/triage. Log, trace and metric sources depend on the installed operators.
See how failure can trigger a reviewed improvement cycle →Run it on your own infrastructure.
Apache 2.0 licensed, self-hosted. cairn pipeline run incident/rca