How marcocristofolini/ai-sre-rca works
AI SRE RCA is a read-only incident investigation service: Alertmanager or API incidents enter the backend, which gathers infrastructure, observability, change, trace, and dependency evidence before returning a structured, evidence-backed RCA. The graph preserves the distinct Kubernetes, trace, and stateful-diagnosis stages, plus memory, access controls, operational reporting, and UI paths. README documents several capabilities whose detailed wiring was not sampled; those subsystems are included where paths are supported, while uncertain internal links are omitted.
Main entry points: engine.py Investigation engine · api.ts Frontend API client · incidents.py Incident API · operations.py Persistence and delivery
Components 25
Entry and access
- Incident API
backend/app/api/incidents.py - Alert webhook
backend/app/api/webhooks.py - System API
backend/app/api/system.py - OIDC and RBAC
backend/app/auth.py
Investigation
- Investigation engine
backend/app/core/engine.py - Kubernetes playbooks
backend/app/core/playbooks.py - Trace analysis
backend/app/core/trace_analysis.py - Dependency RCA
backend/app/core/stateful_dependency.py - Hypothesis scoring
backend/app/core/scoring.py - LLM proposer
backend/app/llm/hypotheses.py
Evidence sources
- Read-only integrations
backend/app/integrations
Memory and operations
- Incident memory
backend/app/db/repository.py - Audit and retention
backend/app/db/repository.py - Persistence and delivery
backend/app/operations.py - Slack and PagerDuty
backend/app/notifications.py
User experience
- Operations UI
frontend/app/ops/page.tsx - Investigation UI
frontend/components/InvestigationView.tsx - Frontend API client
frontend/lib/api.ts - Stateful demo pages
frontend/app/stateful - Trace page
frontend/app/trace/page.tsx
Other components
- Alertmanager
- API user
- Kubernetes
- Prometheus, Loki, Tempo
- Argo CD, GitHub, Karpenter
Connections 28
- Alertmanager → Alert webhook: posts alerts
- API user → Incident API: submits or reads
- Incident API → OIDC and RBAC: authorizes
- Alert webhook → Investigation engine: investigates
- Alert webhook → Persistence and delivery: audits and persists
- Incident API → Investigation engine: investigates
- Incident API → Persistence and delivery: persists results
- System API → OIDC and RBAC: identifies caller
- Investigation engine → Kubernetes playbooks: evaluates signals
- Investigation engine → Trace analysis: analyzes traces
- Investigation engine → Dependency RCA: investigates dependencies
- Investigation engine → Read-only integrations: queries evidence
- Read-only integrations → Kubernetes: reads cluster state
- Read-only integrations → Prometheus, Loki, Tempo: queries telemetry
- Read-only integrations → Argo CD, GitHub, Karpenter: reads change data
- Investigation engine → Incident memory: retrieves similar incidents
- Investigation engine → Hypothesis scoring: evaluates hypotheses
- Investigation engine → LLM proposer: requests proposals
- Persistence and delivery → Incident memory: saves investigations
- Persistence and delivery → Audit and retention: appends audit events
- Persistence and delivery → Slack and PagerDuty: dispatches alerts
- API user → Investigation UI: views results
- Investigation UI → Frontend API client: loads investigation
- Frontend API client → Incident API: fetches incident
- Stateful demo pages → Frontend API client: loads demo data
- Trace page → Frontend API client: loads trace data
- Operations UI → Frontend API client: loads system status
- Frontend API client → System API: fetches identity