Incident Rehearsal
An incident agent that rehearses candidate fixes and proves its rollback path inside a simulator
The problem worth solving
A software incident can have several plausible remedies, and the fastest-looking action may worsen a dependency or discard pending work. An agent that identifies the likely cause has not yet demonstrated that its proposed action is safe. Build an incident rehearsal assistant for a local service simulator with an API tier, queue, worker pool, and database connection budget. It should propose candidate actions, predict their consequences under uncertain assumptions, and execute only simulated plans that satisfy declared invariants and have a tested compensation path.
What could make it stand out
AIOpsLab and ITBench already provide substantial agent incident-evaluation foundations. This proposal narrows the portfolio contribution to paired counterfactual action evaluation and rollback fidelity. The interface explains why a candidate action was rejected even when it would improve the primary service metric. It preserves disagreement between model forecasts and observed simulator outcomes, and treats compensation as a measurable operation. The key artifact is a benchmark of superficially attractive but unsafe incident responses, not another chat interface that paraphrases logs or automatically claims an incident is resolved.
Across held-out simulated incidents, a rehearsal-and-compensation planner will reduce invariant-breaking action plans by at least 40% relative to a direct-action agent while increasing median simulated recovery time by no more than 20%. The hypothesis is falsified if matched action budgets remove the advantage, or if the planner relies on perfectly known simulator parameters that the direct-action baseline is denied.
System architecture
| Component | Responsibility |
|---|---|
| Incident world | Implement service demand, queue depth, deployment versions, worker capacity, and database connection limits. Expose noisy metrics and logs while hiding the exact latent incident cause from the agent. |
| Action contracts | Define a small action vocabulary: change replica count, restore a prior deployment, reduce admitted load, or retry a synthetic job. Each action declares preconditions, observable effects, idempotency behavior, and a compensation operation. |
| Candidate planner | Produce up to three structured action sequences with evidence references and assumptions. Permit an information-gathering action when uncertainty prevents a responsible choice, and cap horizon and tool count. |
| Counterfactual sandbox | Clone the current world, perturb uncertain parameters, and run each proposed sequence. Report primary-metric improvement, dependency impact, invariant violations, and whether compensation returns the relevant state to its snapshot. |
| Execution and incident review | Apply accepted actions only in the local simulator, verify postconditions after each step, and compensate on a failed invariant. Preserve a chronological incident record with prediction errors and abandoned plans. |
Data and reproducibility
Author 90 incidents spanning a bad deployment, traffic surge, exhausted connection pool, slow worker, duplicated job, and stale metric stream. Include normal-load controls and cases where rollback is unavailable. Primary AIOps research informs task structure; the six-week deliverable uses a deliberately small original simulator rather than claiming complete reproduction of either linked benchmark.
Start with a synthetic benchmark
Seed demand profiles and dependency capacities, then inject one or two faults at known evaluator-only times. Preserve identical initial conditions for all baselines. Define unsafe actions with state invariants such as no lost acknowledged work, bounded database connections, and no duplicate completion. Hold out incident combinations and capacity ranges so a rule keyed to incident names cannot solve the evaluation. Include simulator-model mismatch by changing one transition parameter after rehearsal.
Baselines you must beat
- A fixed incident runbook with deterministic trigger conditions and explicit preconditions for each action.
- A direct-action bounded agent that receives the same telemetry, action vocabulary, and total observation budget.
- A planner that simulates only expected primary-metric improvement, without dependency invariants or compensation checks.
Measure the claim
Targets below are proposed success criteria. No results have been achieved on your behalf.
| Metric | Definition and target |
|---|---|
| Unsafe plan rate | Fraction of attempted plans that violate any declared world-state invariant at any intermediate step; report attempted and executed unsafe actions separately. Target, not achieved result: at least 40% relative reduction versus direct action on held-out incidents, with episode-level paired intervals. |
| Simulated time to sustained recovery | Simulator time until the service target is met for five consecutive ticks without a hidden invariant failure; unsuccessful episodes retain a fixed timeout rather than disappearing from averages. Target, not achieved result: median overhead of no more than 20% versus direct action among jointly recovered cases, plus overall recovery-rate reporting. |
| Compensation fidelity | Fraction of failed executions whose declared reversible state fields exactly match the pre-plan snapshot after compensation; separately enumerate effects that cannot be undone. Target, not achieved result: 100% on deterministic reversible fixtures and at least 95% under the declared noisy simulation profile. |
Experiments and ablations
- Use the same candidate plans to compare primary-metric-only scoring with invariant-aware rehearsal. This isolates the action-selection mechanism from differences in language-model plan generation.
- Inject a dependency-capacity change between rehearsal and execution. Test whether postcondition verification triggers compensation and whether the incident review records the model mismatch accurately.
- Sweep planning horizon and rehearsal sample count under a fixed compute budget. Compare safe recovery, latency, and unnecessary abstention rather than optimizing only a single aggregate score.
Your execution plan
0 of 12 deliverables checked. Tick a deliverable after recording evidence in your project repository.
Define incidents and action semantics
Implement world cloning and compensation
Establish incident baselines
Add rehearsal and decision records
Challenge the model assumptions
Publish a reproducible incident study
Working seed
Run this small, deterministic core first. It demonstrates the central mechanism. The complete system, experiments, and deployment are your capstone work.
"""Incident Rehearsal: simulate an action plan and compensate failed execution."""
from copy import deepcopy
import json
def error_fraction(state):
capacity = state["replicas"] * (30 if state["version"] == "bad" else 70)
return round(max(0, state["demand"] - capacity) / state["demand"], 3)
def apply(state, action):
if action == "scale":
state["replicas"] = 4
elif action == "rollback":
state["version"] = "stable"
elif action == "restart_lossy":
state["pending"] = 0
else:
raise ValueError("Unknown simulator action")
def violations(before, after):
errors = []
if after["replicas"] * 45 > after["db_budget"]:
errors.append("db_connection_budget")
if after["pending"] != before["pending"]:
errors.append("pending_work_lost")
return errors
def rehearse(state, plan):
sandbox = deepcopy(state)
trace = []
for action in plan:
before = deepcopy(sandbox)
apply(sandbox, action)
errors = violations(before, sandbox)
trace.append({"action": action, "violations": errors})
if errors:
return {"safe": False, "trace": trace, "predicted_error": None}
return {"safe": True, "trace": trace, "predicted_error": error_fraction(sandbox)}
def execute_with_compensation(state, plan):
snapshot = deepcopy(state)
for action in plan:
before = deepcopy(state)
apply(state, action)
if violations(before, state):
state.clear()
state.update(snapshot)
return "compensated"
return "committed"
def main():
state = {"replicas": 2, "version": "bad", "demand": 100,
"pending": 8, "db_budget": 100}
original = deepcopy(state)
scale = rehearse(state, ["scale"])
rollback = rehearse(state, ["rollback"])
assert not scale["safe"] and rollback["predicted_error"] == 0
assert state == original
assert execute_with_compensation(state, ["rollback", "restart_lossy"]) == "compensated"
assert state == original
assert execute_with_compensation(state, ["rollback"]) == "committed"
print(json.dumps({"before_error": error_fraction(original), "scale": scale,
"rollback": rollback, "after_error": error_fraction(state),
"pending_preserved": state["pending"]}, sort_keys=True, indent=2))
if __name__ == "__main__":
main()
Failure modes to investigate
- A perfectly known world makes rehearsal unrealistically powerful. Give every method the same observations and add held-out parameter changes between prediction and execution.
- Restoring an in-memory snapshot is easier than undoing real distributed effects. Define compensation field by field and do not imply that queue losses or external side effects are reversible in production.
- Recovery metrics can reward dropping work. Verify service health together with preserved acknowledged jobs, bounded dependencies, and duplicate-completion checks.
Your demo, moment by moment
- Start an API incident where a new deployment cuts capacity and the agent proposes both scaling and restoring the prior version.
- Rehearse scaling: latency improves but database connections exceed the allowed budget. Show the precise violated invariant and reject the plan.
- Rehearse and execute the deployment restore in the simulator, then verify sustained recovery and preservation of pending jobs.
- Inject a mismatch during another plan, trigger compensation, and compare the restored state with its snapshot before opening the aggregate evaluation.
Write the resume bullet after the experiment
Replace every placeholder with your actual measurements. Keep the dataset size, baseline, and evaluation conditions available for interview questions.
A research extension
A later version can attach the same contracts to an isolated containerized toy service, keeping production credentials absent. Compare simulator predictions with observed local-system behavior and study which abstractions transfer. Another focused extension ranks the next diagnostic read by expected reduction in action uncertainty, charging both observation delay and rehearsal compute to the incident budget.
Related work to challenge your idea
Provides a framework for agent evaluation across the incident lifecycle. This proposal isolates action rehearsal, model mismatch, and compensation fidelity in a smaller inspectable world.
Establishes broader IT automation evaluation scenarios. The capstone's distinction is a targeted counterfactual benchmark, not a claim to outperform ITBench agents without running their tasks.