Skip to main content
After an incident closes, a second group of agents runs asynchronously to extract learnings, propose code fixes, and maintain your knowledge base. These agents run without blocking the incident response workflow — they’re background processes that produce artifacts you review on your own schedule.

​
Problem Investigator

The Problem Investigator runs when a closed incident matches a known pattern or when the system detects recurrence. What triggers it:
  • Incident closes with a root cause that has appeared before
  • A problem record is manually created from an incident
  • A periodic analysis run identifies a cluster of related incidents
What it does:
  • Correlates the incident with prior related incidents
  • Produces a root cause analysis (RCA) spanning the related incidents
  • Identifies patterns in timing, affected services, and contributing factors
  • Generates a postmortem document
Where results appear:
  • Problem Records page: a new or updated Problem Record with RCA attached
  • Knowledge base repository: a pull request adding a postmortem to .sureops/postmortems/
HITL approval: The postmortem PR requires your review and merge. sureops never merges to your repository automatically.

​
Fix-PR Agent

The Fix-PR Agent attempts to produce a code-level fix for the root cause identified during diagnosis. What triggers it:
  • A closed incident where the Resolution Agent identified a code-level change as the appropriate fix
  • A Problem Record with agent_fix_pr recommendations that were not yet executed
What it does:
  • Opens a draft pull request in the affected service’s repository
  • Populates the PR with a scaffold: file changes, a description of the proposed fix, and references to the incident and postmortem
  • Requests review from the service owner (per your services.yaml ownership config)
Fix-PR code scaffolding is currently in private beta. The agent opens a draft PR with the fix structure and description. Full automated code patch generation is in active development.
Where results appear:
  • A draft pull request in your GitHub repository
  • The incident and Problem Record gain a “Fix PR” link pointing to the open PR
HITL approval: The PR is always opened as a draft. You review, edit, and merge on your own timeline. The agent does not push to a branch directly — it opens a PR for your team’s normal review workflow.

​
Pre-mortem Agent

The Pre-mortem Agent runs proactively before changes ship, not after incidents close. What triggers it:
  • A deployment is detected in your environment (via Kubernetes or ArgoCD events)
  • A manual trigger from a Problem Record or from the pre-mortem feature
What it does:
  • Reviews the proposed change (deployment diff, PR description, service history)
  • Identifies risk factors: prior incidents involving this service, dependency blast radius, recent error rate trends
  • Produces a pre-mortem summary: likelihood of incident, risk areas, recommended monitoring during rollout
Where results appear:
  • Problem Records page: a pre-mortem entry linked to the deployment
  • Optionally, a comment on the pull request that triggered the deployment (if GitHub integration is enabled)
HITL approval: The pre-mortem is advisory — it does not block a deployment. You review it as part of your change management process.

​
Curator

The Curator maintains your knowledge base. It keeps runbooks, incident learnings, and postmortems indexed and searchable. What triggers it:
  • A push to your knowledge base repository (new or updated runbooks)
  • Periodic re-indexing run
  • An incident closes and new postmortem content is available
What it does:
  • Re-indexes new and updated runbook files as vector embeddings
  • Indexes postmortem content for future incident grounding
  • Detects stale runbooks (not reviewed in a configurable period) and surfaces them for attention
  • Identifies runbooks that are frequently retrieved but rarely resolved-against, suggesting they may need updating
Where results appear:
  • Settings → Knowledge Base: updated sync status, service and runbook counts
  • Knowledge base repository: periodic PRs proposing runbook updates for stale entries (optional, configurable)
The Curator does not auto-merge changes to your repository. It opens PRs for review.

​
Ordering and independence

Post-closure agents run asynchronously and independently. The Problem Investigator runs first (it produces the RCA that the Fix-PR Agent may reference). The other agents run in parallel. You can view the status of post-closure agents on the Problem Records page and on individual incident detail pages.

​
Configuring post-closure behavior

Post-closure agent behavior is configured in:
  • Settings → AI Agents: per-agent model and skill overrides
  • .sureops/policy.yaml: fix PR auto-open, draft mode, and reviewer routing
  • Settings → Environment → AI Behavior: whether to auto-trigger post-closure agents or require manual triggering
By default, all post-closure agents run automatically on incident closure. You can set them to manual-trigger if you want to review each incident before analysis begins.