# ydflow/incident-response-agent architecture

> Architecture diagram of the GitHub repository ydflow/incident-response-agent, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ydflow/incident-response-agent
- Repository: https://github.com/ydflow/incident-response-agent

## Overview

故障智巡围绕 Incident 调查、证据驱动诊断与受控处置构建，README 明确说明当前以本地模拟案例和模拟 Executor 演示，未连接生产监控或真实服务操作。主要路径从控制台进入 Incident 工作流，经只读取证工具收集证据，再诊断或升级；处置请求经过策略和可信宿主审批。事件可写入 JSONL 并只读回放。图保留评测与控制台能力；未采样这些实现源码，相关连线依据 README，具体调用归属不确定处不作推断。

Main entry points: [`incident_agent/workflow.py`](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/workflow.py) (调查与诊断), [`src/routes/incident-console.ts`](https://github.com/ydflow/incident-response-agent/blob/main/src/routes/incident-console.ts) (控制台 API), [`src/incident-console-read-model.ts`](https://github.com/ydflow/incident-response-agent/blob/main/src/incident-console-read-model.ts) (控制台读模型), [`incident_agent/events.py`](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/events.py) (JSONL 运行记录)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_console["Incident 控制台"]
  node_console_ui["故障控制台<br/>[ConsolePages.tsx]"]
  node_console_api["控制台 API"]
  node_console_read["控制台读模型"]
end

subgraph group_investigation["调查与诊断"]
  node_incident["Incident 状态机<br/>[state_machine.py]"]
  node_workflow["调查与诊断<br/>[workflow.py]"]
  node_evidence_tools["取证工具"]
  node_fixtures["模拟案例数据"]
  node_evidence["结构化证据<br/>[models.py]"]
end

subgraph group_safety["处置安全"]
  node_policy_gate["风险策略门"]
  node_approval["人工审批控制"]
  node_remediation["模拟处置工具"]
end

subgraph group_trace["追踪与评测"]
  node_event_capture["事件记录<br/>[events.py]"]
  node_event_log["JSONL 运行记录<br/>[events.py]"]
  node_replay["只读回放<br/>[replay.py]"]
  node_evaluation["评测中心"]
end

subgraph group_runtime["Agent Runtime"]
  node_runtime_tools["MCP 工具层<br/>[mcp-tools.ts]"]
  node_agent_runtime["Agent Runtime<br/>[index.ts]"]
end

node_operator(("调查人员"))

node_operator -->|"查看与操作"| node_console_ui
node_console_ui -->|"请求数据"| node_console_api
node_console_api -->|"读取视图"| node_console_read
node_console_read -->|"读取记录"| node_event_log
node_console_read -->|"读取案例"| node_fixtures
node_workflow -->|"推进状态"| node_incident
node_workflow -->|"调用工具层"| node_runtime_tools
node_runtime_tools -->|"运行工具调用"| node_agent_runtime
node_evidence_tools -->|"查询案例"| node_fixtures
node_evidence_tools -->|"构造证据"| node_evidence
node_workflow -->|"使用证据诊断"| node_evidence
node_workflow -->|"提交处置请求"| node_policy_gate
node_policy_gate -->|"创建待审请求"| node_approval
node_approval -->|"批准后执行"| node_remediation
node_workflow -->|"记录过程"| node_event_capture
node_event_capture -->|"追加事件"| node_event_log
node_event_log -->|"重建时间线"| node_replay
node_console_api -->|"提供评测视图"| node_evaluation

click node_console_ui "https://github.com/ydflow/incident-response-agent/blob/main/web/src/features/incident-console/ConsolePages.tsx"
click node_console_api "https://github.com/ydflow/incident-response-agent/blob/main/src/routes/incident-console.ts"
click node_console_read "https://github.com/ydflow/incident-response-agent/blob/main/src/incident-console-read-model.ts"
click node_incident "https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/state_machine.py"
click node_workflow "https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/workflow.py"
click node_evidence_tools "https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-evidence-tools.ts"
click node_fixtures "https://github.com/ydflow/incident-response-agent/tree/main/incident_agent/fixtures"
click node_evidence "https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/models.py"
click node_runtime_tools "https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/mcp-tools.ts"
click node_agent_runtime "https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/runtime/index.ts"
click node_policy_gate "https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-approval-gate.ts"
click node_approval "https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-approval-control.ts"
click node_remediation "https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-remediation-tools.ts"
click node_event_capture "https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/events.py"
click node_event_log "https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/events.py"
click node_replay "https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/replay.py"
click node_evaluation "https://github.com/ydflow/incident-response-agent/blob/main/src/incident-console-evaluation.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_console_ui,node_console_api,node_console_read toneBlue
class node_incident,node_workflow,node_evidence_tools,node_fixtures,node_evidence toneAmber
class node_policy_gate,node_approval,node_remediation toneMint
class node_event_capture,node_event_log,node_replay,node_evaluation toneRose
class node_runtime_tools,node_agent_runtime,node_operator toneIndigo
```

## Components

### Incident 控制台

- [故障控制台](https://github.com/ydflow/incident-response-agent/blob/main/web/src/features/incident-console/ConsolePages.tsx): `web/src/features/incident-console/ConsolePages.tsx`
- [控制台 API](https://github.com/ydflow/incident-response-agent/blob/main/src/routes/incident-console.ts): `src/routes/incident-console.ts`
- [控制台读模型](https://github.com/ydflow/incident-response-agent/blob/main/src/incident-console-read-model.ts): `src/incident-console-read-model.ts`

### 调查与诊断

- [Incident 状态机](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/state_machine.py): `incident_agent/state_machine.py`
- [调查与诊断](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/workflow.py): `incident_agent/workflow.py`
- [取证工具](https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-evidence-tools.ts): `container/agent-runner/src/incident-evidence-tools.ts`
- [模拟案例数据](https://github.com/ydflow/incident-response-agent/tree/main/incident_agent/fixtures): `incident_agent/fixtures`
- [结构化证据](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/models.py): `incident_agent/models.py`

### 处置安全

- [风险策略门](https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-approval-gate.ts): `container/agent-runner/src/incident-approval-gate.ts`
- [人工审批控制](https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-approval-control.ts): `container/agent-runner/src/incident-approval-control.ts`
- [模拟处置工具](https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/incident-remediation-tools.ts): `container/agent-runner/src/incident-remediation-tools.ts`

### 追踪与评测

- [事件记录](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/events.py): `incident_agent/events.py`
- [JSONL 运行记录](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/events.py): `incident_agent/events.py`
- [只读回放](https://github.com/ydflow/incident-response-agent/blob/main/incident_agent/replay.py): `incident_agent/replay.py`
- [评测中心](https://github.com/ydflow/incident-response-agent/blob/main/src/incident-console-evaluation.ts): `src/incident-console-evaluation.ts`

### Agent Runtime

- [MCP 工具层](https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/mcp-tools.ts): `container/agent-runner/src/mcp-tools.ts`
- [Agent Runtime](https://github.com/ydflow/incident-response-agent/blob/main/container/agent-runner/src/runtime/index.ts): `container/agent-runner/src/runtime/index.ts`

### Other components

- **调查人员**

## Connections

- 调查人员 → 故障控制台: 查看与操作
- 故障控制台 → 控制台 API: 请求数据
- 控制台 API → 控制台读模型: 读取视图
- 控制台读模型 → JSONL 运行记录: 读取记录
- 控制台读模型 → 模拟案例数据: 读取案例
- 调查与诊断 → Incident 状态机: 推进状态
- 调查与诊断 → MCP 工具层: 调用工具层
- MCP 工具层 → Agent Runtime: 运行工具调用
- 取证工具 → 模拟案例数据: 查询案例
- 取证工具 → 结构化证据: 构造证据
- 调查与诊断 → 结构化证据: 使用证据诊断
- 调查与诊断 → 风险策略门: 提交处置请求
- 风险策略门 → 人工审批控制: 创建待审请求
- 人工审批控制 → 模拟处置工具: 批准后执行
- 调查与诊断 → 事件记录: 记录过程
- 事件记录 → JSONL 运行记录: 追加事件
- JSONL 运行记录 → 只读回放: 重建时间线
- 控制台 API → 评测中心: 提供评测视图