Perun-Engineering/sre-on-call

<div align="center"> <img src="docs/assets/sre-on-call-logo.png" alt="sre-on-call logo" width="180" height="180"> <h1>sre-on-call</h1> <p><em>A multi-agent bot that automatically investigates infrastructure alerts across Slack and Discord.</em></p> </div>

When an alert is posted to a channel — or an operator reacts to one with the trigger emoji or @mentions the bot in its thread — the system acknowledges it, fans out investigation work to specialized agents in parallel, and posts a structured incident analysis as a thread reply.

Architecture

Slack/Discord webhook
        │
        ▼
   Lambda Adapter ── (signature verify, dedup, classify, ack) ──▶ chat platform
        │
        │ bedrock-agentcore.invoke_agent_runtime (JSON-RPC 2.0 / A2A)
        ▼
   Master Agent  ── investigate_alert tool ──▶ Orchestrator
                                                   │
                  ┌──────────────────┬────────────┼────────────────┐
                  ▼                  ▼            ▼                  ▼
            Slack Scanner     CloudWatch Logs    EKS         Incident History
                                                      (4 specialized agents,
                                                       configured via config.yaml)

• Lambda Adapter — receives Slack/Discord webhooks, verifies signatures, deduplicates via DynamoDB, classifies the mention (suppresses non-alert chatter before the fan-out — see below), then invokes the Master Agent runtime.
• Master Agent — orchestrates the investigation: routes the alert to the relevant agents, fans out, enforces deadlines, synthesizes an Analysis section, and posts the Incident Report. See agents/master/README.md.
• Specialized agents — one per data source. Each has its own README:
  • Slack Scanner — Slack channel history correlation.
  • CloudWatch Logs — discovers real log groups