DevilNReality/Incident-Triage-Reinforcement-Learning

1name: incident-triage-env2version: 1.0.03description: >4  OpenEnv environment for training AI agents to triage production incidents.5  The agent receives production monitoring alerts, identifies the root cause,6  assigns a severity level (P1-P4), and routes to the correct on-call team7  (SRE, Database, Network, or App). Simulates real-world SRE alert fatigue8  at companies like Google, Meta, Netflix, and Amazon.9 10tags:11  - openenv12  - sre13  - devops14  - incident-management15  - real-world16  - alert-routing17  - triage18 19tasks:20  - id: task_easy21    difficulty: easy22    description: Single alert with obvious root cause — one per team variant23    expected_score_frontier: "0.9–1.0"24    expected_score_weak: "0.4–0.6"25    baseline_score: 0.9526    reward_formula: "severity(0.50) + team(0.50)"27    num_scenarios: 428    example_action:29      severity: P230      team: sre31      root_cause: "High CPU utilisation on api-server-03 causing degraded response times."32      suppressed: []33 34  - id: task_medium35    difficulty: medium36    description: Three correlated alerts requiring root cause identification across 4 scenario sets37    expected_score_frontier: "0.5–0.75"38    expected_score_weak: "0.2–0.4"39    baseline_score: 0.6340    reward_formula: "severity(0.35) + team(0.35) + root_cause(0.30)"41    num_scenarios: 442    example_action:43      severity: P144      team: database45      root_cause: "Database overload — postgres query timeouts causing downstream 5xx errors and p99 latency spikes."46      suppressed: []47 48  - id: task_hard49    difficulty: hard50    description: >51      10–15 alerts mixing 6 real alerts (database outage) with 5 noise alerts52      (short-duration, barely-over-threshold). Agent must suppress noise,53      identify root cause, assign P1, and route to Database team.54    expected_score_frontier: "0.2–0.45"55    expected_score_weak: "0.05–0.15"56    baseline_score: 0.3157    reward_formula: "noise_suppression(0.20) + severity(0.25) + team(0.25) + root_cause(0.30) - over_suppress_penalty(0.20 per real alert)"58    noise_detection_rule: "duration_s < 60 AND value < threshold * 1.10"59    num_scenarios: 160    example_action:61      severity: P162      team: database63      root_cause: "Postgres primary overload — replication lag and query timeouts cascading into service-wide 5xx errors."64      suppressed: ["alert-007", "alert-008", "alert-009", "alert-010", "alert-011"]65 66action_space:67  type: object68  fields:69    severity:70      type: string71      enum: [P1, P2, P3, P4]72      description: "Incident severity: P1=Critical (revenue), P2=High (users), P3=Medium (degraded), P4=Low"73    team:74      type: string75      enum: [sre, database, network, app]76      description: "On-call team: sre=infra/capacity, database=DB, network=latency/DNS, app=code/memory"77    root_cause:78      type: string79      description: "Free-text one-sentence root cause. Graded by keyword match against ground truth."80    suppressed:81      type: array82      items: string83      description: "Alert IDs the agent believes are noise. Only scored in task_hard."84 85observation_space:86  type: object87  fields:88    alerts:89      type: array90      description: "List of Alert objects visible to the agent (is_noise field hidden)"91    services_map:92      type: object93      description: "Mapping of service name to responsible team"94    step:95      type: integer96      description: "Current step number within the episode"97    max_steps:98      type: integer99      description: "Maximum steps allowed: easy=3, medium=3, hard=5"100    task_id:101      type: string102      description: "Identifier of the current task"103 104reward:105  type: float106  range: [0.0, 1.0]107  description: >108    Shaped reward signal returned at every step. Partial credit always returned.109    task_easy:   severity(0.5) + team(0.5)110    task_medium: severity(0.35) + team(0.35) + root_cause(0.30)111    task_hard:   noise_suppression(0.20) + severity(0.25) + team(0.25) + root_cause(0.30)112                 penalty: -0.20 per real alert wrongly suppressed (floor 0.0)113  early_termination: "Episode ends early if score >= 0.99 (perfect answer)"114 115server:116  port: 7860117  framework: FastAPI118  endpoints:119    - method: GET120      path: /health121      description: Health check — returns status and version122    - method: GET123      path: /tasks124      description: List all tasks with metadata, grader formulas, expected scores125    - method: POST126      path: /reset127      body: '{"task_id": "task_easy", "seed": 42}'128      description: Start a new episode; picks random scenario variant129    - method: POST130      path: /step131      body: '{"severity":"P1","team":"database","root_cause":"...","suppressed":[]}'132      description: Submit TriageAction; returns observation, reward, done, info133    - method: GET134      path: /state135      description: Full environment state including ground truth (for UI)136 137baseline_scores:138  model: meta-llama/Llama-3.3-70B-Instruct139  api: HuggingFace Inference Router140  task_easy: 0.95141  task_medium: 0.63142  task_hard: 0.31143  notes: >144    Scores from inference.py with chain-of-thought prompting and multi-step145    reflection. task_hard noise suppression is the primary challenge.146 147domain_motivation: >148  Alert fatigue is a $1B+ problem in production engineering. PagerDuty and149  OpsGenie are built around this exact domain. Reducing Mean Time To Detection150  (MTTD) by 5 minutes saves millions in revenue for large-scale systems.151  This environment provides a reproducible, scored benchmark for that skill.152