Status: Proof of concept
Code: github.com/cameronqj/incident-response-agent
Incident automation is mostly an authority problem. A model can suggest a plausible fix; the harder question is whether it should be allowed to act, on what target, for how long, and with what evidence left behind.
This project follows one deliberately narrow remediation path from typed intake through assessment, an immutable proposal, human approval, atomic execution, verification, and audit. Approval grants short-lived authority to perform the exact proposed action. The model never receives open-ended access to the runtime.
What the evidence says
The current evidence includes 114 offline tests, 13 disposable-container tests, and two live integrations. In the strongest end-to-end run, the system took an owned service from HTTP 503 and an unhealthy container state to HTTP 200 and healthy, while preserving the container identity and recording each step.
It is not a production incident-response platform. One bearer token controls mutation, there is no RBAC or production target discovery, and remediation is restricted to disposable resources created by the proof of concept. The container restart is a vehicle for testing approval, telemetry, and authority boundaries, not the product claim.