Incident memory and investigation

Each incident page runs a fixed investigation and shows what your team learned from similar incidents.

Investigation#

The same checks run every time, in this order:

1. What changed in the hour before the incident.
2. Past incidents with the same rule, error pattern or service.
3. How requests moved, and which failing steps grew.
4. What differs in failing requests.

Each lead has a confidence, links to its evidence and a next check. A lead with no evidence is not shown. A check that could not run says so, so a missing lead is never mistaken for a clean result. These are leads, not conclusions.

Record what happened#

On a resolved incident, choose Record what happened. Enter the cause and the fix, and pick the change behind it. The most likely change is already selected. The record is optional.

Past incidents#

New incidents list similar resolved ones, recorded ones first, with what fixed them. The card also shows how many of the service's last 5 incidents followed a change.

API#

MCP#

investigate_incident runs the same checks and returns the leads with their evidence.