Evidence-grounded incident operations
FlowPulse
Agents can accelerate investigation without becoming the source of truth.
A control plane where evidence, lifecycle state, approval, execution receipts, and fresh verification remain authoritative while agents investigate and propose.
Incident workflows become unsafe when a model, browser, or command result can silently stand in for lifecycle state, provenance, approval, or recovery evidence.
Implemented the repository’s incident lifecycle, evidence boundary, canonical projection, investigator/evaluator contracts, allowlisted response path, and verification logic. The repository is public engineering evidence, not a claim of production adoption.
Keep one lifecycle authority in the control plane: agents may propose, but policy and an owner gate decide; only fresh telemetry and checks can close an incident.
The incident lifecycle exposes an execution receipt followed by a fresh-verification step.
- VerifiedOTLP-shaped inputs, an append-only evidence boundary, and a canonical incident projection are implemented.
- VerifiedThe repository includes real UI surfaces, recovery logic, and contract coverage for authority separation.
- Not establishedReal users, rollout stage, on-call ownership, incident volume, and operation beyond local or controlled environments are not established here.
Verified repository code, test output, or history Not established human use, deployment, or impact evidence.
System architecture
Follow the authority boundary from input to verified outcome.Signals
Telemetry and change connectors provide bounded, provenance-preserving observations.
- SourcesCollect bounded signals
- EvidenceKeep provenance attached
- ProjectionOwn lifecycle state
- InvestigateChallenge the diagnosis
- ApproveSeparate advice from authority
- RespondExecute inside an allowlist
- VerifyProve recovery with fresh data
Reproduce / inspect
Start with the shortest proof path.
- Before you start
- Node 20+; external telemetry and deployment credentials are outside this bounded proof path.
- Path
node --test test/evidence-source.test.mjs test/incident-projection.test.mjs test/context-compiler.test.mjs- Observed
- 34 tests passed, 0 failed in about 0.12s; the path exercises evidence-source, incident-projection, and context-compiler behavior.
Evaluation & test evidence
What the inspected evidence supports.
- Behavioral evidenceVerified
Lifecycle, evidence, recovery, and verification contracts are present in the inspected source tree.
- Bounded test runVerified
34 tests passed and 0 failed in about 0.12s across evidence-source, incident-projection, and context-compiler contracts.
- Full-suite caveatVerified
The full suite was interrupted after prolonged execution; at least four failures were visible before interruption.
- ImpactNot established
No production, adoption, or incident-volume comparison is claimed.
Repository depth
Follow the implemented interfaces, behavioral tests, and history behind this case.- Implemented interfaceEvidence envelope
Implemented interface: append-only evidence and provenance boundary.
- Implemented interfaceIncident projection
Implemented interface: canonical lifecycle projection.
- Behavioral testEvidence-source contract
Behavioral test: source admission and provenance behavior.
- Behavioral testProjection contract
Behavioral test: incident lifecycle and projection behavior.
Engineering judgment
One decision, the alternative, and the trade-off.Decision
Keep lifecycle state outside the model in the control plane.
Alternative
Let the browser or model own current incident state and use command success as recovery.
Why
The explicit boundary keeps stale advice, missing evidence, and action receipts inspectable, at the cost of more state transitions.
Failure modes & limits
Public repository · source inspected- The inspected source tree contained uncommitted changes, so this is not presented as a clean release snapshot.
- Stale or insufficient evidence stops the workflow rather than producing a convenient diagnosis.
- A response cannot proceed without policy, owner approval, an allowlisted action, and an execution receipt. The current evidence does not establish healthy production operation, user adoption, or incident impact.
Integrated dependencies
- Temporal
- FastAPI
- PostgreSQL
- MinIO
- OpenTelemetry
- Node.js