The investigator
In LLM mode, the model chooses its next tool based on previous observations. A fixed budget keeps the investigation bounded. Demo mode uses a transparent reference policy instead.
EVIDENCE BEFORE ACTION
Understand the incident.
Show your working.
Follow an investigation from an alert to observations, retrieved runbooks, and a supported diagnosis.
02 / INVESTIGATEREADY
SYNTHETIC INCIDENT
Choose an incident
Read-only tools · cited runbooks
A diagnosis should leave a trail.
Run this incident to see which tools were called, what they found, and which runbook sections informed the response.
Observe→Retrieve→Explain
INVESTIGATION RESULT
WHAT IS ACTUALLY HAPPENING?
One loop. Three building blocks.
The tools
Six allowlisted functions read scenario evidence and search runbooks. There is no shell, mutation tool, arbitrary URL fetch, or live Kubernetes connector.
The knowledge
BM25 retrieves relevant runbook sections. The response cites retrieved chunks and observed evidence. Missing evidence must lead to uncertainty, not an invented diagnosis.