ARCHIVES

Diagnosing production incidents is still largely manual: on-call engineers gather logs, errors and deployment history from separate tools before they can reason about a cause. Large language models (LLMs) can suggest root causes, but a model that sees only an incident summary lacks evidence, and an unchecked suggestion can mislead. This paper aims to give an LLM agent the evidence it needs while keeping a human in control. We present Phase 1 of an open, four-module platform: a non-blocking Java SDK that captures exceptions, latency and deployments; a multi-tenant Spring Boot backend that groups repeated errors into incidents by stack hash; a FastAPI service in which a tool-calling LLM investigates each incident only through audited APIs; and a dashboard where an operator approves or rejects every suggestion. We evaluate it by injecting seven kinds of real faults into an instrumented service. All 21 trials were detected, with mean detection times of 8–12 s for exception faults and 25–45 s for resource faults, and no incident was raised in 8 min of fault-free operation. The SDK added a median of 14 µs per captured error and stayed non-blocking when the backend was down. A successful investigation used about 11k–24k tokens and two to three minutes; of five graded suggestions, two were correct, two partly correct and one wrong despite a confidence of 0.78. The results show that telemetry-grounded investigation is practical for small teams, and that self-reported confidence must not replace human review.