Evals for Traversal

Alert noise reduction and deduplication

Collapsing redundant or symptom-level alerts into one incident rather than emitting parallel investigations

Incident onset detection (MTTD)

Recognizing that an incident has begun from telemetry movement, including before or without a human page

Severity and impact scoping

Assigning severity and blast radius consistent with observed customer-facing impact

Alert-to-incident correlation across services

Grouping alerts that share a causal origin across different systems and owners

Causal vs. correlational discrimination

Separating the true cause from co-occurring but innocent changes such as an unrelated deploy

Multi-layer failure traversal

Following a failure across application, infrastructure, and dependency layers to its origin

Evidence grounding and citation

Tying each RCA claim to specific logs, metrics, traces, or dependency edges

Behavior under sparse or ambiguous signal

Expressing uncertainty or ranked hypotheses instead of asserting a single unsupported cause

Cross-stack querying of existing observability tools

Retrieving relevant telemetry from the customer's incumbent stack without requiring re-instrumentation

Search scoping at petabyte volume

Narrowing to the telemetry of interest rather than exhaustively scanning, within incident-relevant latency

Dependency graph construction and refresh

Building and updating causal service dependencies as the system changes

Coverage gaps and blind spots

Reporting when required telemetry is missing or unreachable instead of reasoning past the gap

Engagement decision and channel setup

Choosing to spin up and take point on a real incident, and staying out of non-incidents

Responder selection and notification

Pulling in the owners actually implicated by the investigation

Escalation on judgment calls

Handing decisions that require human judgment to a named human with options and tradeoffs

Incident communication under pressure

Packaging findings into updates a stressed on-call engineer can consume and act on

Fix drafting from root cause

Proposing a remediation that follows from the diagnosed cause rather than the symptom

Self-healing for known failure classes

Handling repeatable, well-characterized failures such as DDoS or disk errors end to end

Risk gating before acting

Withholding irreversible or high-blast-radius actions pending authorization

Post-action verification and rollback

Confirming the incident actually resolved, and reverting when it did not

Data handling and deployment boundaries

Keeping telemetry access within the customer's stated deployment and residency boundary

Access scoping and least privilege

Reading and acting only within the systems the agent has been granted

Audit trail of agent actions

Producing a reviewable record of what the agent queried, concluded, and did

Outcome metric reporting

Reporting MTTR and RCA-accuracy figures that are traceable to the underlying incidents