Kea
Real-time incident analysis with deterministic root-cause ranking and evidence-backed AI explanations.
Python · FastAPI · Neo4j · Redpanda · Next.js · Codex
1st place · Codex Community Hackathon, Calicut
View sourceThe problem
An outage turns several services red at once. The team must distinguish the original fault from its downstream effects and nearby deployments that had nothing to do with it.
The approach
- Rank causes deterministically using metric events, deployment history, and service dependencies.
- Give the investigation agent read-only evidence and validate its citations.
- Keep proposed fixes in a sandbox, with approval bound to the exact diff hash.
Inside the system
Event stream
A seeded simulator publishes events to Redpanda. An aiokafka worker deduplicates them; Neo4j stores the service topology.
Causality engine
Pure Python detects anomalies and ranks candidates with factor scores and explicit rejection reasons. FastAPI serves the live state.
Investigation and review
An OpenAI-backed agent explains evidence without changing the ranking. Next.js displays topology, timelines, benchmarks, and sandboxed fix proposals.
Decisions and trade-offs
The engine decides; the model explains
Grounding checks validate evidence IDs and numerical claims. Unsupported investigations get a repair attempt, then a labeled template fallback.
Approval records an exact proposal
Codex CLI or a tool-loop backend proposes and checks a sandboxed patch. Approval stores the diff hash; this build does not apply changes or open pull requests.
Benchmark the limits
The harness compares identical incident streams, repeatability, latency, and cost. Real-data results expose an accuracy gap, so the simulated scenarios are not a production-readiness claim.
What it produces
- Won 1st place at the Codex Community Hackathon in Calicut.
- Local incident replay with live topology, cited investigations, and human-reviewed fix proposals.