When production breaks, an LLM agent investigates — grounded in a FalkorDB world-model, disciplined by hard evidence, and honest about what it does not know. It only opens a pull request when the evidence supports it. Research-grade RCA at a €50/month homelab budget.
An alert fires; the agent recalls similar incidents, ranks suspects from the graph, runs a bounded tool-using investigation, and decides by confidence — never auto-remediating. Five research ideas make that possible, each written up as a paper below.
An Alertmanager webhook is de-duplicated, then deterministic passes gather traces, logs and code context before any model call.
Personalized PageRank + BARO change-point scoring rank candidate causes; hybrid memory recalls related past incidents — all without an LLM.
A bounded ReAct loop queries real tools. A verification-gate FSM — not the model — decides when evidence is sufficient to stop.
A confidence ladder, soft-capped by graph grounding, chooses the action: notify, open an issue, attach patches, or open a PR for a human.
A persistent neuro-symbolic world-model in FalkorDB that fuses code, infra, runtime telemetry, change history and past RCA outcomes into one property graph the agent reasons over.
Personalized PageRank over an error-weighted dependency graph, blended with parameter-free BOCPD change-point scoring (BARO) — deterministic graph priors that seed the LLM's hypothesis space. No causal discovery.
An externalized verification-gate FSM governs loop termination; hypothesis state is derived only from hard tool evidence (never LLM-asserted); a grounding-based soft-cap keeps thin conclusions below the auto-PR tier.
Every change passes a deterministic AC@1 / MTTR replay gate with distractor injection, behind a shadow → active rollout — so an LLM-in-the-loop system ships safely against a labelled ground-truth set.
A hand-rolled Graphiti-on-FalkorDB temporal knowledge graph with no-LLM-at-retrieval hybrid recall (semantic + BM25 + graph-BFS, fused by RRF) and Reflexion-style lessons — the agent learns from every incident.
Each idea is written up as a paper below.
What happens when Alertmanager fires: a deterministic pre-LLM stage seeds suspects from the FalkorDB world-model, a bounded ReAct loop reasons against real tools through an MCP fleet — Loki, Tempo, Prometheus, Grafana, Kubernetes and more — with the LLM reached over a Cloudflare AI Gateway, and a verification gate decides when the evidence is enough to act.
One agent, three incidents — the same StackGraph traversal and verification gate each time. Not an LLM guessing: evidence-grounded reasoning over a live world-model, honest enough to only notify when confidence is below the auto-PR bar.
An alert fires. The agent reads signals from three observability sources, traverses the FalkorDB StackGraph to find what changed, and proposes a fix — all before an on-call engineer opens their laptop.
MATCH (svc:Service {name:"api-gateway"})-[:DEPENDS_ON]->(dep:Service) MATCH (dep)-[:LAST_CHANGE]->(c:Commit) WHERE c.deployed_at >= $alert_time - duration("PT2H") AND dep.error_rate > 0.05 RETURN dep.name, c.sha[0..7], c.message, dep.error_rate ORDER BY dep.error_rate DESC ⊥ StackGraph FalkorDB traversal + Tempo trace correlation
a8f3d91 (Victor Robin, 2h before alert) increased query_timeout from 5s to 10s, doubling average connection hold time under load. Draft PR #127 opened to revert. Confidence: 0.87.
A pod keeps dying. The agent correlates restart events with a recent change, walks the StackGraph to the offending commit, and bounds the leak — no human paging required.
MATCH (svc:Service {name:"worker-svc"})-[:LAST_CHANGE]->(c:Commit) MATCH (p:Pod {workload:"worker-svc"})-[:OOM_KILLED]->(e:Event) WHERE c.deployed_at >= $alert_time - duration("PT6H") AND p.rss_ratio > 0.9 RETURN c.sha[0..7], c.message, p.rss_ratio, count(e) AS kills ORDER BY p.rss_ratio DESC ⊥ StackGraph FalkorDB traversal + Prometheus memory series
4c1e7a2 (Victor Robin, 5h before alert) added an unbounded in-process response cache; RSS climbs ~6%/h under load until it hits the 512Mi limit. Draft PR #142 opened to bound the cache with an LRU + TTL. Confidence: 0.91.
Latency cascades and there's no recent deploy. The agent follows the dependency graph to a saturated upstream, finds the cause is load — not a regression — and notifies rather than patching.
MATCH (svc:Service {name:"checkout"})-[:DEPENDS_ON*1..3]->(dep:Service) MATCH (dep)-[:EMITS]->(s:Span) WHERE s.p99_ms > $slo_ms AND s.window = $alert_window RETURN dep.name, s.p99_ms, dep.pool_saturation ORDER BY s.p99_ms DESC ⊥ StackGraph FalkorDB traversal + Tempo span correlation
Research Papers
Each paper follows a scientific structure — abstract, related work, method, evaluation, discussion — and is published here and on ArXiv.
A systems paper on the StackGraph — a single persistent FalkorDB property graph fusing five topology and outcome layers into one world-model, consulted by a graph-free-style ReAct loop, running inside a 50 EUR/month homelab.
A deterministic, training-free pre-LLM scoring layer that seeds an RCA agent's hypothesis space: error-weighted personalized PageRank blame propagation, parameter-free BOCPD change-point onset detection, a BARO-style robust scorer, and a five-term re-normalizing additive blend with provable fail-open collapse — and a principled, CI-enforced refusal of causal discovery.
A systems paper on the reasoning-safety core of the BlueRobin Debug Agent: a deterministic verification-gate FSM outside the model, hypothesis state derived only from real-tool evidence, and a grounding-based soft-cap that bounds LLM self-confidence below the action tiers — all driven by the MAST failure taxonomy.
How the BlueRobin Debug Agent makes every RCA claim measurable and safe to ship: a deterministic offline replay harness over a labelled incident set emitting an AC@1 + MTTR scorecard, a per-commit regression gate that blocks merges, distractor-injected honest-accuracy arms, and a shadow-to-active live-activation rollout — at a 50 EUR/month homelab budget.
How the BlueRobin Debug Agent gives an LLM RCA agent durable, time-aware memory: a bi-temporal MemoryEpisode/MemoryEntity subgraph on the existing FalkorDB, a three-leg hybrid recall (semantic + BM25 + graph-BFS) fused by Reciprocal Rank Fusion with no LLM at retrieval, and Reflexion/Voyager-style post-incident lessons — all inside a ~50 EUR/month homelab budget.
A step-by-step guide to setting up Infisical for secret management, integrating with External Secrets Operator in Kubernetes, and using secrets in .NET applications.
Built with