Testable mechanisms, ranked checks, and evidence assessments.
ADVANCED DEPLOY TO VALUE TRACK
From Agents to Investigation Systems.
A practical series on designing AI systems that investigate incidents through bounded decisions, explicit evidence, deterministic controls, and verifiable stopping conditions.
0 / 11 lesson labs completed
Exercises and design records stay in this browser. Export reports to keep or review your work.
THE PATTERN
Turn investigation into controlled decisions.
RCA supplies the concrete case. The architecture also applies to data quality, operational exceptions, security triage, and other evidence-driven work with uncertain next steps.
Typed capabilities, explicit state, immutable evidence, and budgets.
Mechanism tests, scope coverage, stopping rules, and human ownership.
Recommended background: HTTP services, logs and traces, basic JavaScript or Python, and the AI Agent Design boundary and tool lessons. Reading and browser labs require no installation.
CORE TRACK · LESSONS 01–08
Build the investigation contract.
Move from incident interpretation to a runnable engine, creating a reviewable artifact at every step.
LESSON 01 · CORE
Why Investigation Is a Decision Problem
Turn an incident narrative into observations, testable hypotheses, and a sequence of decisions whose errors can be contained.
OUTPUTIncident reasoning ledger
AVAILABLE · 35–45 minLESSON 02 · COREBuilding the Hypothesis Set
Create a candidate space that covers services, dependencies, infrastructure, and changes without hiding the possibility of a missing cause.
OUTPUTHypothesis tree and prediction table
AVAILABLE · 40–50 minLESSON 03 · COREBounded Decisions Instead of Open-Ended Agents
Split investigation into small judgments with typed inputs, permitted choices, and software-owned transitions.
OUTPUTFive bounded decision contracts
AVAILABLE · 40–50 minLESSON 04 · COREChoosing the Next Best Check
Compare diagnostic checks by the hypotheses they separate, the evidence they can change, and their cost.
OUTPUTCost-aware check-selection record
AVAILABLE · 45–55 minLESSON 05 · COREEvidence, Support, and Falsification
Preserve provenance and identify what would support, contradict, or leave a causal claim unchanged.
OUTPUTSupport and falsification matrix
AVAILABLE · 40–50 minLESSON 06 · CORESeparating the Proposer from the Verifier
Use independent evidence paths and deterministic gates to contain correlated reasoning failures.
OUTPUTInvestigation responsibility and verification contract
AVAILABLE · 40–50 minLESSON 07 · COREStop, Continue, or Escalate
Implement stopping conditions that preserve the difference between strong support, verified scope, and an unresolved handoff.
OUTPUTStopping and escalation policy
AVAILABLE · 35–45 minLESSON 08 · COREDesigning a Production-Grade Investigation Engine
Assemble state, evidence, permissions, budgets, and a bounded judge into one replayable diagnostic workflow.
OUTPUTRunnable investigation engine and report
AVAILABLE · 55–75 minADVANCED TRACK · LESSONS 09–11
Test the system where certainty breaks.
Missing causes, misleading symptoms, simultaneous faults, and evaluation of the full investigation process.
LESSON 09 · ADVANCED
When the Root Cause Is Missing
Detect candidate-set failure and expand through scoped topology and effective-change evidence.
OUTPUTHypothesis expansion record
AVAILABLE · 45–60 minLESSON 10 · ADVANCEDAmbiguous and Misleading Incidents
Follow causal ordering and cohort boundaries through symptoms, partial outages, and simultaneous faults.
OUTPUTMulti-cohort causal account
AVAILABLE · 50–65 minLESSON 11 · ADVANCEDEvaluating Investigation Systems
Score candidate coverage, unsafe conclusions, diagnostic behavior, abstention, and replay alongside final answers.
OUTPUTDeterministic evaluation report
AVAILABLE · 50–65 minCAPSTONE
Build an AI Investigation System.
Explain a simulated distributed application through bounded checks, an evidence ledger, scoped verification, and replayable reports.
Engineering references for this track · Troubleshooting, observability, and bounded workflow design.