Investigation summaries

An alert tells you something tripped. The investigation that follows is the same every time: what changed since yesterday, which customers saw it, and what the failing runs have in common. Agent Ping does that first pass for you and sends it with the alert, so the person on call reads the note instead of opening five tabs.

What arrives

Below the alert's own text, one paragraph headed Investigation, at most four sentences:

Investigation: Failures rose from 0% to 75% over the last 24 hours while cost went from $2.00 to $11.00, with p95 duration up from 0.5s to 9.5s. Two customers were hit, acme (2 failed runs) and globex (1). Every failed run carries the error "RateLimitError: tool quota exceeded" and all of them ran version v2, which first appeared three hours ago; v1 runs did not fail.

Webhooks carry the same text in a top-level investigation field, so the alert JSON stays as it was with one additive key.

Which alerts

  • Spend anomalies (spend.anomaly)
  • Missed schedules (agent.overdue)
  • Failing rubrics (rubric.failing)
  • Incidents opening from an alert rule (incident.opened), when the rule targets an agent

Recoveries, reminders and team-wide incidents are not investigated.

What the summary is built from

The evidence is the agent's own data, nothing else:

  • The last 24 hours against the 24 before: runs, failed runs, failure rate, cost, p95 duration, tokens.
  • Customers with failed runs in the last 24 hours, with counts.
  • The most common error messages on failed runs (output.error or metadata.error, as the run page reads them).
  • Versions seen in the last 24 hours and when each was first ever seen on the agent, so a label that appeared this morning stands out.
  • The latest judge verdicts and their reasoning.
  • The alert's own numbers: the anomaly against its baseline, the rubric score and the judge's reasoning, the minutes overdue.

Claude is asked to use those numbers, to name a cause only when the evidence points to one, and to say so in one sentence when it does not. It never sees prompt or completion text.

Plans and cost

Team and Business plans. One summary per alert, shared across every channel the alert goes to, so a spike that pages Slack, PagerDuty and a webhook costs one model call. An alert is never held up by the investigation: a slow or failed call sends the alert as before, without the paragraph.

Turning it off

There is no per-team switch yet. If you would rather not have the paragraph, tell us and we will turn it off for your account.