Auro-rium/Ops-Incident-Core

IncidentOps Core

IncidentOps is an engineering-evidence backend for incident investigation. It ingests repository and operational evidence through a deterministic Collector, indexes it with Core, and returns project-scoped search and investigation results with citations and missing-evidence warnings.

Version context: This repository is the active V2 rewrite. It is not a production deployment. Azure model resources exist, but no Azure Container Apps, PostgreSQL, Redis, Qdrant, Collector, frontend, or MCP runtime is currently deployed in the inspected subscription.

Product Boundary

The useful claim is narrow and testable:

• ingest code, documentation, configuration, API contracts, logs, deploy records, runbooks, and incident notes through normalized documents;
• retrieve evidence with citations and query-aware diagnostics;
• explain what evidence exists and what is missing;
• produce cautious answers instead of unsupported root-cause certainty.

A repository alone cannot explain a runtime outage. Runtime investigation needs timestamped logs, deploy/change context, and often incident history.

Architecture

flowchart LR
  F[apps/web on Vercel] -->|authenticated browser HTTP| API[FastAPI Core API]
  C[In-repository Collector] -->|redacted NormalizedDocument batches| API
  API --> PG[(PostgreSQL metadata and audit)]
  API --> Q[(Qdrant vectors)]
  API --> R[(Redis queue and limits)]
  R --> W[Core worker]
  W --> PG
  W --> Q
  API --> RET[Intent routing and hybrid retrieval]
  RET --> E[Compact cited evidence]
  E --> A[Direct answer or optional Azure OpenAI synthesis]
  M[Core MCP server] -->|Core API only| API

Core owns authentication, RBAC, project isolation, source/sync state, normalization validation, chunking, indexing, retrieval, investigation, workflow runs, evals, readiness, audit events, and MCP-facing tools.

Collector can read an approved source and submit normalized documents. It does not access the database, normalize