Workspace/Capstone studio
Loading progress
Capstone studio
SITE RELIABILITY ENGINEERING, COUNTERFACTUAL PLANNING, AND RECOVERY · 6-WEEK BLUEPRINT

Incident Rehearsal

An incident agent that rehearses candidate fixes and proves its rollback path inside a simulator

The problem worth solving

A software incident can have several plausible remedies, and the fastest-looking action may worsen a dependency or discard pending work. An agent that identifies the likely cause has not yet demonstrated that its proposed action is safe. Build an incident rehearsal assistant for a local service simulator with an API tier, queue, worker pool, and database connection budget. It should propose candidate actions, predict their consequences under uncertain assumptions, and execute only simulated plans that satisfy declared invariants and have a tested compensation path.

What could make it stand out

AIOpsLab and ITBench already provide substantial agent incident-evaluation foundations. This proposal narrows the portfolio contribution to paired counterfactual action evaluation and rollback fidelity. The interface explains why a candidate action was rejected even when it would improve the primary service metric. It preserves disagreement between model forecasts and observed simulator outcomes, and treats compensation as a measurable operation. The key artifact is a benchmark of superficially attractive but unsafe incident responses, not another chat interface that paraphrases logs or automatically claims an incident is resolved.

YOUR FALSIFIABLE HYPOTHESIS

Across held-out simulated incidents, a rehearsal-and-compensation planner will reduce invariant-breaking action plans by at least 40% relative to a direct-action agent while increasing median simulated recovery time by no more than 20%. The hypothesis is falsified if matched action budgets remove the advantage, or if the planner relies on perfectly known simulator parameters that the direct-action baseline is denied.

System architecture

ComponentResponsibility
Incident worldImplement service demand, queue depth, deployment versions, worker capacity, and database connection limits. Expose noisy metrics and logs while hiding the exact latent incident cause from the agent.
Action contractsDefine a small action vocabulary: change replica count, restore a prior deployment, reduce admitted load, or retry a synthetic job. Each action declares preconditions, observable effects, idempotency behavior, and a compensation operation.
Candidate plannerProduce up to three structured action sequences with evidence references and assumptions. Permit an information-gathering action when uncertainty prevents a responsible choice, and cap horizon and tool count.
Counterfactual sandboxClone the current world, perturb uncertain parameters, and run each proposed sequence. Report primary-metric improvement, dependency impact, invariant violations, and whether compensation returns the relevant state to its snapshot.
Execution and incident reviewApply accepted actions only in the local simulator, verify postconditions after each step, and compensate on a failed invariant. Preserve a chronological incident record with prediction errors and abandoned plans.

Data and reproducibility

Author 90 incidents spanning a bad deployment, traffic surge, exhausted connection pool, slow worker, duplicated job, and stale metric stream. Include normal-load controls and cases where rollback is unavailable. Primary AIOps research informs task structure; the six-week deliverable uses a deliberately small original simulator rather than claiming complete reproduction of either linked benchmark.

Start with a synthetic benchmark

Seed demand profiles and dependency capacities, then inject one or two faults at known evaluator-only times. Preserve identical initial conditions for all baselines. Define unsafe actions with state invariants such as no lost acknowledged work, bounded database connections, and no duplicate completion. Hold out incident combinations and capacity ranges so a rule keyed to incident names cannot solve the evaluation. Include simulator-model mismatch by changing one transition parameter after rehearsal.

Baselines you must beat

  1. A fixed incident runbook with deterministic trigger conditions and explicit preconditions for each action.
  2. A direct-action bounded agent that receives the same telemetry, action vocabulary, and total observation budget.
  3. A planner that simulates only expected primary-metric improvement, without dependency invariants or compensation checks.

Measure the claim

Targets below are proposed success criteria. No results have been achieved on your behalf.

MetricDefinition and target
Unsafe plan rateFraction of attempted plans that violate any declared world-state invariant at any intermediate step; report attempted and executed unsafe actions separately.

Target, not achieved result: at least 40% relative reduction versus direct action on held-out incidents, with episode-level paired intervals.

Simulated time to sustained recoverySimulator time until the service target is met for five consecutive ticks without a hidden invariant failure; unsuccessful episodes retain a fixed timeout rather than disappearing from averages.

Target, not achieved result: median overhead of no more than 20% versus direct action among jointly recovered cases, plus overall recovery-rate reporting.

Compensation fidelityFraction of failed executions whose declared reversible state fields exactly match the pre-plan snapshot after compensation; separately enumerate effects that cannot be undone.

Target, not achieved result: 100% on deterministic reversible fixtures and at least 95% under the declared noisy simulation profile.

Experiments and ablations

  1. Use the same candidate plans to compare primary-metric-only scoring with invariant-aware rehearsal. This isolates the action-selection mechanism from differences in language-model plan generation.
  2. Inject a dependency-capacity change between rehearsal and execution. Test whether postcondition verification triggers compensation and whether the incident review records the model mismatch accurately.
  3. Sweep planning horizon and rehearsal sample count under a fixed compute budget. Compare safe recovery, latency, and unnecessary abstention rather than optimizing only a single aggregate score.

Your execution plan

0 of 12 deliverables checked. Tick a deliverable after recording evidence in your project repository.

WEEK 1

Define incidents and action semantics

WEEK 2

Implement world cloning and compensation

WEEK 3

Establish incident baselines

WEEK 4

Add rehearsal and decision records

WEEK 5

Challenge the model assumptions

WEEK 6

Publish a reproducible incident study

Working seed

Run this small, deterministic core first. It demonstrates the central mechanism. The complete system, experiments, and deployment are your capstone work.

main.py
python
"""Incident Rehearsal: simulate an action plan and compensate failed execution."""
from copy import deepcopy
import json


def error_fraction(state):
    capacity = state["replicas"] * (30 if state["version"] == "bad" else 70)
    return round(max(0, state["demand"] - capacity) / state["demand"], 3)


def apply(state, action):
    if action == "scale":
        state["replicas"] = 4
    elif action == "rollback":
        state["version"] = "stable"
    elif action == "restart_lossy":
        state["pending"] = 0
    else:
        raise ValueError("Unknown simulator action")


def violations(before, after):
    errors = []
    if after["replicas"] * 45 > after["db_budget"]:
        errors.append("db_connection_budget")
    if after["pending"] != before["pending"]:
        errors.append("pending_work_lost")
    return errors


def rehearse(state, plan):
    sandbox = deepcopy(state)
    trace = []
    for action in plan:
        before = deepcopy(sandbox)
        apply(sandbox, action)
        errors = violations(before, sandbox)
        trace.append({"action": action, "violations": errors})
        if errors:
            return {"safe": False, "trace": trace, "predicted_error": None}
    return {"safe": True, "trace": trace, "predicted_error": error_fraction(sandbox)}


def execute_with_compensation(state, plan):
    snapshot = deepcopy(state)
    for action in plan:
        before = deepcopy(state)
        apply(state, action)
        if violations(before, state):
            state.clear()
            state.update(snapshot)
            return "compensated"
    return "committed"


def main():
    state = {"replicas": 2, "version": "bad", "demand": 100,
             "pending": 8, "db_budget": 100}
    original = deepcopy(state)
    scale = rehearse(state, ["scale"])
    rollback = rehearse(state, ["rollback"])
    assert not scale["safe"] and rollback["predicted_error"] == 0
    assert state == original
    assert execute_with_compensation(state, ["rollback", "restart_lossy"]) == "compensated"
    assert state == original
    assert execute_with_compensation(state, ["rollback"]) == "committed"
    print(json.dumps({"before_error": error_fraction(original), "scale": scale,
                      "rollback": rollback, "after_error": error_fraction(state),
                      "pending_preserved": state["pending"]}, sort_keys=True, indent=2))


if __name__ == "__main__":
    main()

Failure modes to investigate

  • A perfectly known world makes rehearsal unrealistically powerful. Give every method the same observations and add held-out parameter changes between prediction and execution.
  • Restoring an in-memory snapshot is easier than undoing real distributed effects. Define compensation field by field and do not imply that queue losses or external side effects are reversible in production.
  • Recovery metrics can reward dropping work. Verify service health together with preserved acknowledged jobs, bounded dependencies, and duplicate-completion checks.

Your demo, moment by moment

  1. Start an API incident where a new deployment cuts capacity and the agent proposes both scaling and restoring the prior version.
  2. Rehearse scaling: latency improves but database connections exceed the allowed budget. Show the precise violated invariant and reject the plan.
  3. Rehearse and execute the deployment restore in the simulator, then verify sustained recovery and preservation of pending jobs.
  4. Inject a mismatch during another plan, trigger compensation, and compare the restored state with its snapshot before opening the aggregate evaluation.

Write the resume bullet after the experiment

Measured [actual result] change in unsafe action plans and [actual recovery overhead] across [actual incident count] held-out simulated incidents; built counterfactual rehearsal, postcondition verification, and compensation tracing for an SRE agent.

Replace every placeholder with your actual measurements. Keep the dataset size, baseline, and evaluation conditions available for interview questions.

A research extension

A later version can attach the same contracts to an isolated containerized toy service, keeping production credentials absent. Compare simulator predictions with observed local-system behavior and study which abstractions transfer. Another focused extension ranks the next diagnostic read by expected reduction in action uncertainty, charging both observation delay and rehearsal compute to the incident budget.

Related work to challenge your idea

Provides a framework for agent evaluation across the incident lifecycle. This proposal isolates action rehearsal, model mismatch, and compensation fidelity in a smaller inspectable world.

Establishes broader IT automation evaluation scenarios. The capstone's distinction is a targeted counterfactual benchmark, not a claim to outperform ITBench agents without running their tasks.