RootX – AI-Powered Incident Intelligence Platform

"Instead of monitoring systems, it thinks like an experienced Site Reliability Engineer."

---

🌟 Executive Overview

RootX is an enterprise-grade incident intelligence platform designed to eliminate alert fatigue and dramatically shrink MTTR (Mean Time to Resolution). It ingests logs, metrics, and cloud events, clusters thousands of noisy alerts into single coherent incidents, coordinates a 5-Agent Cooperative Multi-Agent AI system, simulates cascading blast radius on a Live Digital Twin, predicts impending component crashes before they happen, enforces Human-in-the-Loop (HITL) remediation guardrails, and auto-generates versioned postmortems.

---

⚡ Core Architecture & 5-Agent SRE System

Logs / Metrics / Cloud Telemetry
             │
             ▼
 ┌────────────────────────┐
 │  AI Alert Correlation  │ ➔ Compresses 1,800+ noisy alerts into 1 incident cluster
 └───────────┬────────────┘
             │
 ┌───────────┴───────────────────────────────────────────────────────┐
 │               5-AGENT COOPERATIVE SRE REASONING                   │
 ├────────────────────────────┬──────────────────────────────────────┤
 │ 1. Log Analysis Agent      │ 2. Root Cause Agent                  │
 │    • Error signature parsing│    • Causal dependency graph        │
 │    • Metric anomaly check   │    • 96%+ explainable confidence    │
 ├────────────────────────────┼──────────────────────────────────────┤
 │ 3. Impact Analysis Agent   │ 4. Recovery Planner Agent            │
 │    • Digital Twin blast map│    • Step-by-step mitigation runbook │
 │    • Revenue & SLA impact   │    • Dry-run sandbox & approvals    │
 │    • Crash failure predictor│    • Safety circuit breakers        │
 ├────────────────────────────┴──────────────────────────────────────┤
 │ 5. Incident Reporter Agent                                        │
 │    • Interactive timeline replay                                  │
 │    • Versioned INC-XXXX_postmortem.md & immutable audit trail     │
 └────────────────────────────┬──────────────────────────────────────┘
                              │
 ┌────────────────────────────┴──────────────────────────────────────┐
 │             ENTERPRISE SRE CONSOLE & RAG ENGINE                   │
 ├───────────────────────────────────────────────────────────────────┤
 │ • 3-Pane Layout: Left (Catalog/Alerts) | Center (Topology) | Right│
 │ • Interactive Digital Twin Canvas with live p99/CPU/Error badges │
 │ • Resizable Docked Bottom Terminal with live log streaming & CLI  │
 │ • Interactive AI SRE Chat ("Why did this happen?", "Seen before?")│
 │ • Historical Incident Knowledge Base (RAG) semantic search        │
 └───────────────────────────────────────────────────────────────────┘

---

🚀 Quickstart

Prerequisites

• Python 3.10+ (Standard library — zero third-party installation required to launch!)

Running the Application

From the project directory:

python run.py

This starts the backend server on http://127.0.0.1:8000 and automatically opens your default browser.

---

🎮 Live Demonstration Guide (For Presentation / Judging)

1. Observe Baseline Health:

   • The Digital Twin displays 10 microservices connected by dependency vectors.
   • Live telemetry pills show nominal operational metrics (p99 < 35ms, error rate < 0.1%, healthy green status).
   • The docked terminal streams live standard output logs.

2. Inject a Realistic Failure Scenario:

   • In the top navigation, select "Postgres DB Connection Pool Saturation (P1)" and click 🔥 Inject Outage.
   • Alert Storm Compression: The left pane collapses 1,842 raw alerts into 1 incident.
   • Digital Twin Degradation: Postgres and Auth nodes pulse red; edge vectors highlight failing connections.
   • Failure Prediction Banner: Notice the early prediction warning: "Ingress worker thread pool exhaustion likely within 7.5 minutes (94.2% confidence)".

3. Trigger Cooperative Multi-Agent AI Triage:

   • Click ⚡ Start AI Triage.
   • Watch all 5 agents execute in sequence:
     • Log Agent: Extracts connection pool error signatures.
     • Root Cause Agent: Traverses causal graph with 96.8% confidence.
     • Impact Agent: Calculates 65% blast radius and financial impact ($1,420/min).
     • Recovery Agent: Generates actionable dry-run runbooks.
     • Reporter Agent: Prepares the formal postmortem.

4. Interact with AI SRE Copilot:

   • Click on the 💬 AI SRE Chat tab and try asking:
     • "Why did this happen?" → Explains the unclosed JWT transaction in auth-service.
     • "Have we seen this before?" → RAG searches past incident memory and returns verified historical solutions.
     • "Show only Kubernetes issues" → Filters pod replica and node-pool warnings.
     • "What changed before the incident?" → Correlates recent CI/CD deployments.

5. Execute Human-in-the-Loop Remediation:

   • Under the Recovery Plan, click 🧪 Dry-Run to preview execution without side-effects in the bottom terminal.
   • Click 🛡️ Approve & Run as Senior SRE to apply the fix.
   • The Digital Twin and telemetry seamlessly recover back to healthy green!

6. View Auto-Generated Postmortem:

   • Click 📄 View & Export Postmortem to inspect the structured 5-Whys review, timeline replay, and download the versioned .md file.

---

🛡️ Enterprise Guardrails Included

• RBAC Enforcement: Junior engineers have read-only diagnostic visibility, while Senior SRE approval is required for mutating commands.
• Safety Circuit Breakers: Prevents runaway automation loops (rate-limits restarts to max 3 / 10 mins).
• Immutable Audit Trail: Logs every agent inference step, user approval, and webhook dispatch for SOC2/ISO compliance.