Synchronous jobs
POST /analysis-jobs runs the pipeline in the request. The console button waits. For local sample files this is seconds, not minutes. Failures return 400 with the job marked failed in the store.
Grounded analysis · heuristic compose · optional Groq or OpenAI
Compiler
Each run writes a timestamped artifact directory. If a later stage degrades, earlier JSON remains inspectable. Think of this page as the IR dump of an incident compiler — not a progress spinner.
POST /analysis-jobs runs the pipeline in the request. The console button waits. For local sample files this is seconds, not minutes. Failures return 400 with the job marked failed in the store.
Intermediate pipeline cache and compose cache live under artifacts/cache. Identical prompts reuse compose output. Delete the cache directory if you change heuristic copy and need a fresh narrative.
CSV, JSON, and JSONL become typed log events and metric points. Invalid rows are counted, not silently dropped.
Log ingestion accepts .csv, .json, and .jsonl. Metric ingestion accepts the same plus a Prometheus query_range adapter. Each row is validated against LogEvent or MetricPoint. Quality metrics — parse failures, missing timestamps, unknown services — land in the run summary instead of disappearing.
Timestamps lock to UTC. Signals align into five-minute buckets so detectors share one clock.
Naive timestamps are assumed UTC. Offset-aware values are converted. Events then fold into configurable buckets (default five minutes) so a latency spike and an error-log burst in the same window can actually meet.
Latency, error rate, CPU, memory, traffic, and availability each have their own z-score and MAD gates.
Detectors are independent. A quiet CPU series does not suppress an error-rate spike. Support windows, z-thresholds, MAD multipliers, and minimum relative change all live in configs/default.yaml.
Anomalies group by time, service, and the dependency graph. Isolated noise stays isolated.
Temporal distance, same-service bonus, dependency edges, and cross-signal bonuses are weighted. A lonely traffic blip without companions does not become an incident.
RCA scores origin vs blast radius. Downstream pain is not automatically the cause.
checkout-service saturating while api-gateway pages is a classic trap. The scorer applies a downstream bonus and an upstream penalty so the origin is preferred when the graph agrees.
Every claim is checked against detector output and retrieved runbooks. Unsupported prose is marked.
Grounding policy can warn or fail. Overlap against evidence ids is measured. Citations from runbooks and historical incidents attach as snippets, not as vibes.
The report is assembled from ranked evidence. Optional Groq or OpenAI can rewrite; the facts never leave the bundle.
Default compose is a deterministic narrative over the evidence JSON: summary, RCA, executive, handoff, remediations. The console shows facts on the left and the rewrite on the right. Toggle heuristic vs Groq on the same incident — detectors do not run twice.
Draft, reviewed, approved, rejected. Approved reports can leave through a webhook with an audit log.
Transitions require a reviewer name and a note. Webhook destinations must match the allowlist. Delivery attempts are appended as JSONL under the run's exports directory.
After a console run, open artifacts/ui/<scenario>/<run_id>/ beside this page. The files below are the contract with the UI.
normalized/timeline.json
UTC buckets and aligned events
anomalies/anomalies.json
Every detector hit with observed vs baseline
incidents/incidents.json
Correlated candidates and evidence lists
rca/rca_hypotheses.json
Ranked origin, support, ambiguities
grounding/grounding_summary.json
Claim overlap and policy result
reports/final_reports.json
The document the console renders
run_summary.json
Stages, warnings, degraded flags, token usage
exports/webhook_deliveries.jsonl
Audit of outbound approved reports
The console always runs the full compiler. These commands exist when you need a single stage, a demo directory, or an eval compare.
run-demo
Deterministic portfolio run under artifacts/demo/portfolio-demo
run-pipeline
Full compiler: ingest through compose and persist artifacts
detect-anomalies
Detectors only — useful when you are tuning YAML gates
correlate-incidents
Group detector hits with the dependency graph
run-rca
Rank origin without generating prose
list-reports / show-report
Inspect review state and a single document
export-report
JSON, Markdown, or HTML from an artifact directory
run-eval / compare-eval
Benchmark modes against eval/golden/baseline_summary.json