AAIRPSTACK
Livev0.4.0 · Temporal · Triage · Semantic memory→

AIRPSTACK

The AI Operations
Engineer

AI-Powered Incident Response Platform · Built by Arsalan Aziz

Autonomous agents that investigate incidents, collect evidence, identify root causes, and execute human-approved remediation.

See an investigation→ArchitectureView Source

Under construction

AIRP Operations ConsoleLive

Incidents

  • #1842high

    PostgreSQL write timeout

    db-primary-01

  • #1841medium

    CPU saturation under load

    api-gateway-03

  • #1840low

    DNS resolution failure

    checkout-svc

Incident #1842

triage running

PostgreSQL write timeout

Primary replica exceeded 95% write latency for 10 minutes.

Category
database
Priority
P1

21:04:11 › PagerDuty webhook received incident.triggered

21:04:11 › Normalize → fingerprint → dedupe NEW incident

21:04:12 › Incident #1842 committed status=open severity=high

█

Built and Running

The Actual Product

Not mockups — screenshots of the AIRP operator console running against the working AIRP backend, showing real incidents and AI analysis output. Click any screenshot to view it full size.

Incident console

airp.local/incidentsAIRP operator console — filterable incident list with severity badges and triage status

Filterable incident list — status, severity, triage state, assignee, and last update.

Agent analysis & timeline

airp.local/incidents/1842Incident detail — AI summary, recommendation, and operational event timeline

Incident detail — AI summary, recommendation, event timeline, and lifecycle actions.

Console states

airp.local/incidents?severity=criticalAIRP operator console — filter empty state

Deliberate empty and edge states — the console is a product surface, not a demo page.

Incident Investigation

A Real Outage, End to End

Walk a PostgreSQL write-timeout from PagerDuty through ingest, Temporal IncidentWorkflow, the live Triage Agent with semantic historical retrieval, and the operator console — the same path AIRP runs in v0.4.0.

POST /integrations/pagerduty/webhookjson
event_typeincident.triggered
servicepayments-api
titlePostgreSQL write timeout
assetdb-primary-01
severitycritical

A production write-path alert hits AIRP over Cloudflare Tunnel — not a toy payload, a real PagerDuty v3 incident.triggered webhook.

Pipeline status

  1. PagerDuty Alertshipped
  2. Temporal Workflowshipped
  3. Triage Agentshipped
  4. Semantic Memoryshipped
  5. Evidence Collectionroadmap
  6. Root Cause & Fixroadmap

The Problem

Too Many Tools, Too Little Time

Modern IT operations teams rely on disconnected tools — ServiceNow, Grafana, Prometheus, PagerDuty, Datadog, cloud providers, and internal dashboards. Engineers spend valuable time correlating alerts, searching historical incidents, gathering evidence, and executing repetitive runbooks.

High MTTR

Mean time to resolution suffers from manual correlation

Alert Fatigue

Unrelated events flood engineers without deduplication

Lost Knowledge

Institutional expertise walks out the door with every incident

AIRP becomes the orchestration layer across these systems — reducing MTTR, improving operational consistency, and preserving organizational knowledge.

Architecture

End-to-End Incident Flow

Click a stage to see the agents and platform components behind it — from PagerDuty through Temporal workflows, triage, semantic memory, human approval, and closed-loop learning.

  • Triage Agent

    Shipped · v0.4.0

    OpenAI Agents SDK — get_incident_context + get_historical_context. Category, priority, evidence plan, and investigation rationale. GET /incidents/{id}/triage.

  • Evidence / Investigation Agent

    Roadmap · v0.5.0

    Collects metrics, logs, service health, and dependency status via MCP tools from the triage evidence plan.

  • Root Cause / Recommendation Agent

    Roadmap · v0.5.0

    Correlates gathered evidence into root cause analysis and proposed remediation steps.

Agent handoff

Triage Agent

Shipped · v0.4.0

Runs on the agents-triage worker after ingest commits — grounded by Qdrant historical matches, structured output with evidence_to_collect for the next agent.

Evidence / Investigation Agent

Roadmap · v0.5.0

Executes the triage evidence plan — system metrics, application logs, service health, and more.

Root Cause / Recommendation Agent

Roadmap · v0.5.0

Reasons over collected evidence and proposes remediation with confidence scoring.

Open Source

AIRP Platform

AI-Powered Incident Response Platform — built by AIRPStack Engineering. Ingest, Temporal workflows, agentic triage with semantic historical memory, and a Next.js console.

External links are placeholders (example.com) until public release. Screenshots and architecture below are from the AIRP console (Triage Agent, semantic memory, PagerDuty).

AIRPSTACK

AI-Powered Incident Response Platform

Built by AIRPStack Engineering

  • FastAPI
  • PostgreSQL
  • Temporal
  • OpenAI Agents SDK
  • Triage Agent
  • Qdrant semantic search
  • SentenceTransformers
  • PagerDuty Webhooks
  • Next.js Web UI
  • Docker Compose
View SourceArchitectureDocumentation

v0.4.0 · Temporal workflows · Triage Agent · semantic memory

PagerDuty / POST /events / POST /incidents
        │
        ▼
FastAPI commit → Postgres incident
        │
        ▼
Temporal IncidentWorkflow  incident-{id}
        ├── agents-triage  →  Triage Agent + get_historical_context
        └── embeddings     →  Qdrant upsert (airp-incidents)
        │
        ▼
Operator console  GET /incidents/{id}/triage

Architecture diagram

End-to-end AIRP architecture — PagerDuty ingress, Temporal IncidentWorkflow, Triage Agent with semantic historical retrieval, and the full multi-agent roadmap. See interactive flow for shipped vs planned stages.

AIRP architecture — ingestion, PostgreSQL, Temporal workers, operator UI, and LLM services

API documentation

REST endpoints (API key auth). Interactive OpenAPI is at /docs when running locally in development.

  • POST/eventsIngest → normalize → dedupe → incident → IncidentWorkflow
  • POST/events/rawPersist raw event only (debug)
  • GET/eventsList operational events
  • GET/events/{id}Operational event detail
  • POST/integrations/pagerduty/webhookPagerDuty v3 webhook → EventIngest → IncidentWorkflow (pagey.ping → 200)
  • GET/incidentsFilter by status / severity / triage_status + pagination
  • POST/incidentsCreate incident and start IncidentWorkflow
  • GET/incidents/{id}Incident detail
  • GET/incidents/{id}/triageLatest structured triage result (category, evidence plan)
  • PATCH/incidents/{id}Update lifecycle, assignment, closure
  • POST/incidents/{id}/reopenReopen a closed incident (audit)
  • GET/incidents/{id}/eventsEvents linked to incident
  • GET/healthLiveness
  • GET/health/readyReadiness (DB + LLM config)
Full reference in README →

Demo video

End-to-end walkthrough: ingest an event, dedupe, and LLM analysis.

Coming soon

Embed when recorded

Set airpMedia.demoVideoUrl to your YouTube or Vimeo embed URL in lib/airp-project.ts.

Tech Stack

What AIRP Is Built With

Production-grade tooling across AI, backend, frontend, and cloud — v0.4.0 ships Temporal workflows, the Triage Agent, and semantic historical memory.

Shipping today

  • Python 3.12Platform core
  • FastAPIAsync REST API
  • PostgreSQLIncident, event & triage store
  • SQLAlchemy + AlembicAsync ORM & migrations
  • TemporalIncidentWorkflow, workers, pending-triage reconciler
  • OpenAI Agents SDKTriage Agent — OpenAI is the only LLM provider
  • QdrantVector store — semantic incident retrieval
  • SentenceTransformersall-MiniLM-L6-v2 embeddings for index + search
  • PagerDutyInbound v3 webhook connector
  • Cloudflare TunnelSecure public webhook ingress
  • Next.jsOperator console & this site
  • PresidioPII / secret sanitization
  • Docker ComposeAPI + web + Postgres + Qdrant + Temporal
  • Cloudflare WorkersEdge deployment (OpenNext)
  • GitHub ActionsCI/CD, tests, security scans

Building now · v0.4.0 follow-on

  • Hugging Face datasetsExternalCuratedKnowledge schema exists; import gated off
  • Runbook corpusIndex operational docs alongside incidents
  • Closed-loop evalProve retrieved history changes triage quality

On the roadmap

  • Grafana / DatadogAdditional alert connectors
  • MCPEvidence collection & remediation tools
  • Evidence / Investigation AgentExecute triage evidence plans
  • SlackNotifications & approvals

Guiding Principles

Built for Trust

Every architectural decision answers one question: does this make AIRP a better AI Operations Engineer?

01

Evidence before action

02

Human approval before impactful remediation

03

Every action is auditable

04

Vendor-neutral integrations

05

Security by default

06

Every incident improves future investigations

Development Roadmap

Building in Phases

Four deliberate phases from core incident infrastructure to continuous learning — each mapped to platform components and workflow steps.

01

Event Intake & Incidents

Ingest → normalize → dedupe → incidents, plus open/investigating/resolved/closed lifecycle, filters, and pagination (AIRP v0.2).

Complete
Event IngestionDeduplication EngineIncident Service
02

AI Agents, Console & Connectors

v0.4.0: Temporal IncidentWorkflow after ingest; Triage Agent on agents-triage; operator console with triage and index_status; PagerDuty webhooks. Investigation agents still ahead.

In Progress
Triage AgentTemporal WorkflowsOperator DashboardMonitoring GatewayInvestigation Engine
03

Approval & Execution Engine

Multi-agent orchestrator (triage, evidence, root cause, recommendation), human-in-the-loop approvals, and safe MCP-based remediation (AIRP v0.5.0+).

Planned
Policy EngineExecution Engine
04

Knowledge Base & Continuous Learning

v0.4.0 shipped semantic memory over AIRP incidents — embeddings worker indexes after triage, Qdrant top-5 retrieval, PostgreSQL hydration. ExternalCuratedKnowledge schema exists; Hugging Face import, runbooks, and live retrieval eval next.

In Progress
Knowledge ServiceVerification EngineLearning Engine

The builder

Built by Arsalan Aziz

Senior Backend Engineer

Senior Backend Engineer building AI-native operational systems with Python, FastAPI, Temporal workflows, agentic triage, RAG, distributed systems, and infrastructure automation.

AIRPStack is not a prompt demo. It is a designed incident pipeline — ingest, Temporal workflows, a live Triage Agent with semantic historical memory, operator console, and Qdrant retrieval — built, deployed, and iterated as a production-shaped system.

  • Python / FastAPI
  • Temporal workflows
  • Agentic triage
  • RAG & retrieval
  • Distributed systems
GitHubArchitecture

Under construction