Name: Production Incident Commander
Brand: Tetrees AI
Availability: InStock

Tetrees Agent guide

What this agent does

During an outage, responders jump between alerts, logs, metrics, traces, topology, and recent changes; weak timelines and untested hunches create noisy investigations and risky remediation.

Designed for

On-call engineers and incident commanders
SRE and platform teams
Teams building runbooks and synthetic incidents
Engineering managers reviewing postmortems

Inputs it works with

Alert, symptom, severity, and incident time window
Metrics, logs, traces, topology, deploys, and events
Service objectives, ownership, and runbooks
Approved-action boundaries and rollback options

Outputs you receive

Incident timeline and blast-radius map
Ranked hypothesis table with evidence
Reversible mitigation and rollback plan
Root-cause and contributing-factor report
Postmortem action and monitoring checklist

How the workflow runs

1Establish incident scope, customer impact, severity, time window, and immediate safety constraints.
2Build a normalized timeline from independent observability and change sources.
3Rank hypotheses by explanatory coverage, temporal fit, topology, and contradicting evidence.
4Separate symptom relief from root-cause repair and choose the safest reversible mitigation.
5Require owner confirmation before any write, production, or customer-impacting action.
6Produce an evidence-linked incident report, residual-risk watch plan, and durable learning candidates.

Example usage

Start with one of these requests, then replace the details with your own.

Diagnose a database connection storm

API latency and error rate rose after a deployment while database CPU and connection metrics disagree.

Example request

Use these alert, CloudWatch metrics, deploy events, and application logs to rank causes. Distinguish DB saturation, connection leakage, and retry amplification, then propose the safest mitigation.

Expected outcome: A normalized timeline, correlated evidence, ranked hypotheses, disconfirming checks, a reversible mitigation, rollback criteria, and no unapproved production action.

Review whether a noisy alert is causal

Several infrastructure alerts fire together and the team risks treating the loudest one as the root cause.

Example request

Analyze this incident bundle. Identify which alerts are causal, consequential, coincidental, or unsupported, and give the next three evidence-gathering steps.

Expected outcome: A topology- and time-aware correlation report, evidence gaps, confidence, safe next checks, and a bounded incident status update.

A successful run should

✓ Timeline and topology support the root-cause claim
✓ Counterevidence is recorded
✓ Mitigation is reversible and has rollback criteria
✓ No production write occurs without explicit approval
✓ Postmortem actions are specific and testable

Boundaries and limitations

• Hosted mode is read-only and cannot mutate infrastructure
• Incomplete telemetry can prevent a confident diagnosis
• Correlation is not proof of causation
• Human incident command remains responsible for production decisions

Capabilities

incident triageevidence correlationroot cause analysismitigation planningpostmortem

Choose OpenAI, Claude or Z.AI in Agent Studio, then run with Tetrees Points or BYOK.

Execution tools

Hosted runs use only this signed set. Local MCP may add tools that you separately configure and approve.

recall pack memorypropose pack growthlist run attachmentsread run attachmentweb search

Agent AVCP

Agent AVCP report

Tested v1.0.0

The tested TAIP artifact is bound to this report and platform signature. Scores describe tested evidence, not a guarantee of every future model response.

Overall score

9.5

out of 10

Security9.5

Function10.0

Completion10.0

Mandatory gates

provenance✓ Pass

costCeilings✓ Pass

growthRollback✓ Pass

skillExecution✓ Pass

Reviews

No reviews yet.

Production Incident Commander