RKB109 commited on
Commit
8828169
·
verified ·
1 Parent(s): 2cea068

Publish artifacts for agentic-incident-response-20260816

Browse files
Files changed (5) hide show
  1. README.md +61 -0
  2. evaluation.json +5 -0
  3. inference.py +80 -0
  4. model.json +222 -0
  5. project.json +52 -0
README.md ADDED
@@ -0,0 +1,61 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ ---
2
+ license: mit
3
+ library_name: custom
4
+ pipeline_tag: text-classification
5
+ datasets:
6
+ - RKB109/agentic-incident-response-20260816-dataset
7
+ tags:
8
+ - synthetic-data
9
+ - transparent-baseline
10
+ - llm-agents
11
+ - text-classification
12
+ - text-generation
13
+ - summarization
14
+ - question-answering
15
+ metrics:
16
+ - accuracy
17
+ ---
18
+
19
+ # Agentic Incident Response Orchestrator Baseline Model
20
+
21
+ ## Model Description
22
+
23
+ This repository contains a small, transparent prototype model for
24
+ **Production teams need agentic automation without allowing an LLM-style planner to execute unsafe remediation.**
25
+
26
+ The model combines per-label token weights with IDF-weighted evidence
27
+ retrieval. It was generated for reproducible architecture demonstrations and
28
+ does not call a hosted LLM.
29
+
30
+ ## Evaluation
31
+
32
+ - Held-out synthetic examples: 4
33
+ - Accuracy: 1
34
+ - Intended metrics: tool_routing_accuracy, unsafe_action_block_rate, plan_completion
35
+
36
+ ## Intended Use
37
+
38
+ - Architecture prototyping
39
+ - CI and evaluation examples
40
+ - Local baseline comparisons
41
+ - Educational experimentation
42
+
43
+ ## Hugging Face Task Coverage
44
+
45
+ - `text-classification`
46
+ - `text-generation`
47
+ - `summarization`
48
+ - `question-answering`
49
+
50
+ ## Limitations and Risks
51
+
52
+ The generated agent uses simulated tools. Production integrations must enforce least privilege and human approval.
53
+
54
+ The dataset is synthetic and small. Do not use this model for consequential
55
+ decisions without representative data, expert review, and production-grade
56
+ evaluation.
57
+
58
+ ## Reproducibility
59
+
60
+ The linked GitHub repository includes `train.py`, the exact dataset split,
61
+ evaluation code, and the model JSON format.
evaluation.json ADDED
@@ -0,0 +1,5 @@
 
 
 
 
 
 
1
+ {
2
+ "test_examples": 4,
3
+ "accuracy": 1,
4
+ "synthetic_evaluation": true
5
+ }
inference.py ADDED
@@ -0,0 +1,80 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ """Transparent baseline pipeline for the generated AI project."""
2
+
3
+ from __future__ import annotations
4
+
5
+ import json
6
+ import math
7
+ import re
8
+ from pathlib import Path
9
+
10
+
11
+ def tokenize(value: str) -> list[str]:
12
+ return re.findall(r"[a-z0-9]+", value.lower())
13
+
14
+
15
+ class Pipeline:
16
+ def __init__(self, model: dict):
17
+ self.model = model
18
+
19
+ @classmethod
20
+ def from_file(cls, path: str | Path) -> "Pipeline":
21
+ return cls(json.loads(Path(path).read_text(encoding="utf-8")))
22
+
23
+ def classify(self, text: str) -> tuple[str, float]:
24
+ tokens = tokenize(text)
25
+ scores = {
26
+ label: sum(weights.get(token, 0) for token in tokens)
27
+ for label, weights in self.model["prototypes"].items()
28
+ }
29
+ ranked = sorted(scores.items(), key=lambda item: (-item[1], item[0]))
30
+ label, best = ranked[0]
31
+ total = sum(max(score, 0) for _, score in ranked) or 1
32
+ return label, best / total
33
+
34
+ def search(self, query: str, limit: int = 3) -> list[dict]:
35
+ query_tokens = set(tokenize(query))
36
+ ranked = []
37
+ for document in self.model["documents"]:
38
+ document_tokens = set(tokenize(document["text"]))
39
+ lexical = sum(
40
+ self.model["idf"].get(token, 1.0)
41
+ for token in query_tokens & document_tokens
42
+ )
43
+ ranked.append({**document, "score": round(lexical, 6)})
44
+ return sorted(ranked, key=lambda item: (-item["score"], item["id"]))[:limit]
45
+
46
+ def graph_evidence(self, text: str) -> list[dict]:
47
+ tokens = set(tokenize(text))
48
+ matches = []
49
+ for subject, relation, target in self.model.get("graph_edges", []):
50
+ edge_tokens = set(tokenize(f"{subject} {relation} {target}"))
51
+ overlap = len(tokens & edge_tokens)
52
+ if overlap:
53
+ matches.append(
54
+ {
55
+ "subject": subject,
56
+ "relation": relation,
57
+ "target": target,
58
+ "overlap": overlap,
59
+ }
60
+ )
61
+ return sorted(matches, key=lambda item: -item["overlap"])
62
+
63
+ def run(self, text: str) -> dict:
64
+ label, confidence = self.classify(text)
65
+ evidence = self.search(text)
66
+ result = {
67
+ "prediction": label,
68
+ "confidence": round(confidence, 4),
69
+ "requires_review": confidence < self.model["confidence_threshold"],
70
+ "evidence": evidence,
71
+ }
72
+ if self.model["mode"] == "graph":
73
+ result["graph_evidence"] = self.graph_evidence(text)
74
+ if self.model["mode"] == "agent":
75
+ result["proposed_tool"] = label
76
+ result["approval_required"] = label in {
77
+ "request-approval",
78
+ "request-human-help",
79
+ }
80
+ return result
model.json ADDED
@@ -0,0 +1,222 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "format": "daily-project-prototype-v1",
3
+ "project": "agentic-incident-response",
4
+ "title": "Agentic Incident Response Orchestrator",
5
+ "domain": "llm-agents",
6
+ "mode": "agent",
7
+ "labels": [
8
+ "inspect-logs",
9
+ "query-metrics",
10
+ "open-ticket",
11
+ "request-approval"
12
+ ],
13
+ "prototypes": {
14
+ "inspect-logs": {
15
+ "find": 3,
16
+ "the": 6,
17
+ "error": 3,
18
+ "messages": 3,
19
+ "around": 3,
20
+ "deployment": 3,
21
+ "timestamp": 3,
22
+ "search": 3,
23
+ "structured": 3,
24
+ "logs": 3,
25
+ "for": 8,
26
+ "correlated": 3,
27
+ "exceptions": 3,
28
+ "in": 2,
29
+ "an": 4,
30
+ "operations": 2,
31
+ "review": 2,
32
+ "evaluation": 2,
33
+ "case": 2,
34
+ "inspect": 3,
35
+ "stack": 3,
36
+ "traces": 6,
37
+ "repeated": 6,
38
+ "timeout": 3,
39
+ "failures": 3,
40
+ "group": 3,
41
+ "errors": 3,
42
+ "and": 3,
43
+ "preserve": 3,
44
+ "representative": 3
45
+ },
46
+ "query-metrics": {
47
+ "in": 1,
48
+ "an": 2,
49
+ "operations": 1,
50
+ "review": 1,
51
+ "show": 2,
52
+ "latency": 2,
53
+ "and": 4,
54
+ "error": 2,
55
+ "rate": 2,
56
+ "for": 3,
57
+ "the": 2,
58
+ "checkout": 2,
59
+ "service": 4,
60
+ "query": 2,
61
+ "level": 2,
62
+ "telemetry": 2,
63
+ "compare": 2,
64
+ "it": 2,
65
+ "with": 2,
66
+ "baseline": 2,
67
+ "evaluation": 1,
68
+ "case": 1
69
+ },
70
+ "open-ticket": {
71
+ "create": 2,
72
+ "a": 2,
73
+ "tracked": 2,
74
+ "incident": 4,
75
+ "for": 3,
76
+ "the": 2,
77
+ "payment": 2,
78
+ "outage": 2,
79
+ "open": 2,
80
+ "an": 3,
81
+ "record": 2,
82
+ "with": 2,
83
+ "evidence": 2,
84
+ "and": 2,
85
+ "ownership": 2,
86
+ "evaluation": 1,
87
+ "case": 1
88
+ },
89
+ "request-approval": {
90
+ "restart": 2,
91
+ "the": 4,
92
+ "production": 2,
93
+ "database": 2,
94
+ "destructive": 2,
95
+ "or": 2,
96
+ "state": 2,
97
+ "changing": 2,
98
+ "actions": 2,
99
+ "require": 4,
100
+ "explicit": 2,
101
+ "approval": 2,
102
+ "in": 2,
103
+ "an": 5,
104
+ "operations": 2,
105
+ "review": 2,
106
+ "scale": 2,
107
+ "service": 2,
108
+ "to": 2,
109
+ "twenty": 2,
110
+ "replicas": 2,
111
+ "capacity": 2,
112
+ "changes": 2,
113
+ "approved": 2,
114
+ "remediation": 2,
115
+ "plan": 2,
116
+ "for": 1,
117
+ "evaluation": 1,
118
+ "case": 1
119
+ }
120
+ },
121
+ "idf": {
122
+ "search": 2.252763,
123
+ "structured": 2.252763,
124
+ "logs": 2.252763,
125
+ "for": 2.252763,
126
+ "correlated": 2.252763,
127
+ "exceptions": 2.252763,
128
+ "query": 2.252763,
129
+ "service": 2.252763,
130
+ "level": 2.252763,
131
+ "telemetry": 2.252763,
132
+ "and": 1.559616,
133
+ "compare": 2.252763,
134
+ "it": 2.252763,
135
+ "with": 1.847298,
136
+ "baseline": 2.252763,
137
+ "open": 2.252763,
138
+ "an": 1.847298,
139
+ "incident": 2.252763,
140
+ "record": 2.252763,
141
+ "evidence": 2.252763,
142
+ "ownership": 2.252763,
143
+ "destructive": 2.252763,
144
+ "or": 2.252763,
145
+ "state": 2.252763,
146
+ "changing": 2.252763,
147
+ "actions": 2.252763,
148
+ "require": 1.847298,
149
+ "explicit": 2.252763,
150
+ "approval": 2.252763,
151
+ "group": 2.252763,
152
+ "repeated": 2.252763,
153
+ "errors": 2.252763,
154
+ "preserve": 2.252763,
155
+ "representative": 2.252763,
156
+ "traces": 2.252763,
157
+ "capacity": 2.252763,
158
+ "changes": 2.252763,
159
+ "approved": 2.252763,
160
+ "remediation": 2.252763,
161
+ "plan": 2.252763
162
+ },
163
+ "documents": [
164
+ {
165
+ "id": "agent-01",
166
+ "label": "inspect-logs",
167
+ "text": "Search structured logs for correlated exceptions.",
168
+ "metadata": {
169
+ "synthetic": true,
170
+ "domain": "llm-agents"
171
+ }
172
+ },
173
+ {
174
+ "id": "agent-02",
175
+ "label": "query-metrics",
176
+ "text": "Query service-level telemetry and compare it with baseline.",
177
+ "metadata": {
178
+ "synthetic": true,
179
+ "domain": "llm-agents"
180
+ }
181
+ },
182
+ {
183
+ "id": "agent-03",
184
+ "label": "open-ticket",
185
+ "text": "Open an incident record with evidence and ownership.",
186
+ "metadata": {
187
+ "synthetic": true,
188
+ "domain": "llm-agents"
189
+ }
190
+ },
191
+ {
192
+ "id": "agent-04",
193
+ "label": "request-approval",
194
+ "text": "Destructive or state-changing actions require explicit approval.",
195
+ "metadata": {
196
+ "synthetic": true,
197
+ "domain": "llm-agents"
198
+ }
199
+ },
200
+ {
201
+ "id": "agent-05",
202
+ "label": "inspect-logs",
203
+ "text": "Group repeated errors and preserve representative traces.",
204
+ "metadata": {
205
+ "synthetic": true,
206
+ "domain": "llm-agents"
207
+ }
208
+ },
209
+ {
210
+ "id": "agent-06",
211
+ "label": "request-approval",
212
+ "text": "Capacity changes require an approved remediation plan.",
213
+ "metadata": {
214
+ "synthetic": true,
215
+ "domain": "llm-agents"
216
+ }
217
+ }
218
+ ],
219
+ "graph_edges": [],
220
+ "confidence_threshold": 0.18,
221
+ "trained_on_synthetic_data": true
222
+ }
project.json ADDED
@@ -0,0 +1,52 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "name": "Agentic Incident Response Orchestrator",
3
+ "problem": "Production teams need agentic automation without allowing an LLM-style planner to execute unsafe remediation.",
4
+ "domain": "llm-agents",
5
+ "architecture": "agent",
6
+ "hugging_face_tasks": [
7
+ "text-classification",
8
+ "text-generation",
9
+ "summarization",
10
+ "question-answering"
11
+ ],
12
+ "recommended_stack": [
13
+ "FastAPI for incident and approval APIs",
14
+ "LangGraph for durable multi-agent orchestration",
15
+ "PostgreSQL for checkpoints and audit events",
16
+ "Redis for queues, locks, and idempotency",
17
+ "OpenTelemetry plus Prometheus and Grafana",
18
+ "Docker Compose for reproducible service integration"
19
+ ],
20
+ "real_world_data_sources": [
21
+ {
22
+ "name": "GitHub Events API",
23
+ "url": "https://api.github.com/events?per_page=10",
24
+ "purpose": "Real deployment and repository activity events"
25
+ },
26
+ {
27
+ "name": "Hacker News API",
28
+ "url": "https://hacker-news.firebaseio.com/v0/topstories.json",
29
+ "purpose": "Public event-stream input for routing and summarization"
30
+ }
31
+ ],
32
+ "job_description_skills": [
33
+ "Multi-agent planning and tool orchestration",
34
+ "Human-in-the-loop approval and durable execution",
35
+ "Idempotent integrations and failure recovery",
36
+ "Telemetry-driven agent evaluation",
37
+ "Least-privilege production automation"
38
+ ],
39
+ "impact_targets": [
40
+ "Route >= 90% of reviewed incidents to the correct first tool",
41
+ "Block 100% of state-changing actions without approval",
42
+ "Resume interrupted plans without duplicate tool execution",
43
+ "Reduce simulated time-to-triage by >= 40% versus manual routing"
44
+ ],
45
+ "baseline_evaluation": {
46
+ "test_examples": 4,
47
+ "accuracy": 1,
48
+ "synthetic_evaluation": true
49
+ },
50
+ "estimated_delivery": "8-12 weeks for one engineer",
51
+ "generated_baseline_is_production_ready": false
52
+ }