AI incident investigation feature map
Availability: preview
This map describes the existing incident application, not a supported production
release or the planned generic Harness UI. Console paths below are relative to
your own console origin; replace :key and :id with a project key and incident ID.
Console features
Section titled “Console features”| Module | Entry point | Current behavior |
|---|---|---|
| Projects and configuration | /projects/:key/configuration/edit |
Configure Git, Source, Trigger, LLM, Automatic hotfix, and Review. Each configuration step saves independently. |
| SSH log monitoring | Collection source → SSH / Host process; Trigger → Managed log probe | Browse remote log files, configure manual or AI-generated rules, install or update the probe, inspect status, and uninstall it. |
| Project notifications | /projects/:key/configuration/notifications |
Configure multiple Telegram, Feishu, WeCom, Slack, Discord, or WhatsApp channels, send tests, inspect the latest 100 deliveries, and retry eligible failures. |
| Event stream | /projects/:key/observations |
Inspect observations, filter the current page by level or message/service/source, and refresh manually. |
| Incidents | Project navigation: Incidents | Browse incidents with incremental loading and inspect evidence. Set Open, Recovered, or Closed manually. |
| Investigation and remediation | /projects/:key/incidents/:id |
Review diagnosis, citations, plans, suggested diff, attempts, recovery information, and hotfix delivery when present. Available actions depend on server state and policy. |
| Authentication | Login and sidebar Sign out | Use the single configured identity and cookie session. No multi-user role model is available. |
Event stream pages contain 25 observations. Search, level filtering, and count badges apply only to the loaded page, not the full event history. The incident list loads in batches of 25. Neither view should be treated as an exhaustive search across all stored signals.
Configuration and integrations
Section titled “Configuration and integrations”| Area | Configure or inspect | Detailed guide |
|---|---|---|
| Git and deployment baseline | Repository credentials and a readable deployment baseline | Git and baseline |
| Runtime evidence | Project Source settings, including supported Tencent CLS or SSH Docker configuration | Tencent CLS and first project |
| SSH file-log signals | SSH host, readable file path, and managed custom-rule trigger | SSH log monitoring |
| Incoming signals | Project Trigger settings and signed webhook credentials | Signed webhooks |
| Outgoing notifications | Project notification channels and delivery history | Project notifications |
| Model provider | Provider credentials, model selection, and chat test | LLM providers |
| Repair policy | Analysis-only or automatic hotfix policy, write credentials, validation, and change limits | Automatic hotfix |
| Server and session | Environment configuration and bootstrap identity | Configuration and authentication |
A configured integration does not guarantee that a run obtained useful evidence. Inspect the incident’s actual evidence and execution outcome before trusting a conclusion. Keep credentials in the configuration boundary, not in signal payloads.
Capability boundaries
Section titled “Capability boundaries”analysis_onlyis the default repair policy. A diagnosis or suggested diff does not mean a write or validation occurred.- Automatic hotfix can prepare a branch, run containerized pre-validation tests, and publish a draft pull request under configured policy. It does not automatically merge, deploy, roll back, or confirm recovery.
- AWS-origin incidents remain analysis-only; enabling project repair policy does not override that source boundary.
- Generic event/run/call/artifact product surfaces and the production installation bundle remain planned.
- Local Harness is a separate development composition. Its readiness is not implied by incident-console features.
Use product status for the readiness matrix, operator workflow for routine operation, and troubleshooting when a configured workflow fails.