Production incidents,
under control.

Aegis investigates failures, correlates evidence, localises root causes, tests remediations in isolation and verifies that they actually worked — then either acts within a deterministic policy or asks a human, with the full case already assembled.

Signal
Cause
Code
Fix
Proof
Action

Operational reasoning

Watch the incident become understandable.

Every conclusion is tied to telemetry, topology, recent change, code, prior incidents and verification results. Nothing is asserted that cannot be traced back to something observed.

INC-2471 · checkout latency degradationIllustrative

Signal correlated
Elevated p99 latency on checkout, connection-pool saturation on the orders database and a deploy 4 minutes earlier all fall inside the same window.
00:14
Blast radius established
Topology shows three downstream services depend on checkout. Two are customer-facing, which raises the required approval tier.
00:21
Change localised
Commit 91f2d7 altered connection lifecycle in the checkout repository. Two symbols and the test covering them identified.
00:32
Hypothesis under test
The leak reproduces under burst traffic in a sandbox with no network and no production credentials. The candidate patch is running against the same reproduction.
01:08
Production action gated
Awaiting staging proof and deterministic risk classification. Rollback plan recorded; nothing reaches production until both pass.
—

A reliability control plane

AI that behaves like a system, not a chat window.

Investigate

Correlate alerts, metrics, traces, logs, topology, deployments and incident history into a hypothesis stack where every claim cites the evidence that supports it.

Localise

Narrow from affected service to endpoint, repository, recent commits, changed files and symbols, instead of handing an entire codebase to a model and hoping.

Reproduce

Run the failure and the candidate fix in a disposable container with no network, no inherited environment and no production credentials of any kind.

Verify

Treat a remediation as a claim that must be proven against the original incident condition, with protected metrics checked for regressions at the same time.

Act safely

Put deterministic policy, risk tiers, approvals, resource leases, kill switches and rollback plans between the reasoning and anything that touches production.

Learn

Write verified outcomes into structured incident memory so recurring patterns surface during the next investigation — and refuse to store anything unverified.

Safety model

What Aegis will not do.

These are structural properties of the codebase, not settings. Several are enforced by the type system rather than by review.

A model can never authorise its own production action.
An agent produces a proposal. Only the gate chain can mint the type an executor accepts, and agents have no way to construct it.
A conclusion with no evidence is rejected, not softened.
Citations are re-validated against stored evidence. A diagnosis that cites an id the model invented becomes an abstention.
"We found nothing" never masquerades as "we could not look".
An unreachable source is recorded as an evidence gap and lowers confidence. It is rendered distinctly, end to end.
An observability outage cannot read as a healthy service.
A verification claim whose metric could not be measured resolves as unavailable, and an unavailable claim can never reach a verified verdict.
Some actions have no executable path at all.
Destructive operations are representable so policy can name and block them, but no executor is registered — there is nothing to call.
An expired approval is not an approval.
Authorisation is re-checked immediately before the write, and an approval that lapsed while queued escalates instead of running.
Abstention is a first-class answer.
Insufficient evidence is reported as insufficient evidence. The benchmark scores over-confidence and over-abstention alike.

Production incidents,under control.