Project 01 / 10 · Agents
Incident Copilot
Production-ready incident response copilot that unifies logs, metrics and on-call knowledge into one conversational command surface — grounded retrieval, not guesswork.
01 / Context
The problem
Incident response depends on team-specific history, but ordinary chat logs do not change how an agent behaves. This system turns prior incidents, durable reasoning steps, reusable lessons, and feedback into operational memory that is recalled before the agent responds to a new alert.
02 / System workflow
From input to output
- 01Production alert
- 02Titan Embed V2
- 03Vector recall
- 04Bedrock reasoning
- 05Resolution + feedback
03 / Architecture
Inside the system
Episodic memory stores resolved incidents with 1,024-dimensional embeddings; semantic memory stores reusable lessons with confidence scores.
Working memory persists sessions and reasoning steps, while recall events record which memories influenced each response.
AWS Lambda runs the agent, Bedrock handles embeddings and tool-using reasoning, CockroachDB keeps relational and vector state transactional, and S3 stores postmortems.
04 / Engineering decisions
What shaped the build
Decision 01
Trust-aware recall
Similarity is adjusted by lesson confidence, so helpful memories become easier to retrieve and poor memories decay through human feedback.
Decision 02
Consistency over convenience
Vectors and incident rows commit together, avoiding the synchronization gap created by a separate vector store.
Decision 03
Measured abstention
The shipped distance threshold favors refusing an unrelated precedent over returning a confident but unsafe match.
05 / Evidence
Measured, not implied
88%
Recall@1
Correct incident ranked first on the live evaluation set.
0.875
MRR
Measured with deliberately low lexical overlap between alerts and matches.
100%
Abstention
Both no-answer control alerts correctly returned no memory.
06 / Delivery
What shipped
- 01Lambda Function URL exposes alert, session, recall, feedback, and statistics endpoints.
- 02ECS Fargate hosts the Streamlit demonstration interface; SAM and CloudFormation define the infrastructure.
- 03The evaluation script measures retrieval against a live CockroachDB cluster instead of relying on qualitative examples.
Constraint documented
A threshold of 0.80 recovers every known match but leaks one control case. The shipped 0.70 threshold accepts lower recall to protect abstention quality.