**
🌋 Hypocenter: The On-Call Agent That Won’t Blame Your Deploy Without Proof
**No path, no blame. How a graph made my AI agent honest 🔍
🚨 13:40. Production is on fire.
30% of mobile logins are failing. Seven services are screaming red. 🔴 Three deploys, a config change and a feature flag all landed in the last hour.
Which one broke production? 🤔
Most incident tools just show you that things are burning. Some take a guess at why, and the guess is almost always “the latest deploy.” On the faults I planted for testing, that guess is right only 50% of the time. 😬 The other half? You roll back the wrong thing while the real cause keeps burning. 🔥
💡 The Big Idea
I built Hypocenter for Graph Hacks (WeMakeDevs × FalkorDB) around one unbreakable rule:
⚡ No path, no blame. A change can be a suspect only if the graph connects it to the failing service, and it leads only if the alerts climb that path in order.
🌍 Fun fact: an earthquake’s epicenter is where you feel it on the surface. The hypocenter is where it actually started, deep underneath. That’s exactly what this agent hunts for. 🎯
🧠 How It Works
Hypocenter keeps a FalkorDB graph for every company 🕸️: services and who calls whom, owners and the on-call rota, every deploy, config change and flag, every alert, and every incident already solved.
When an incident opens, four agents take it in turn: 🕵️ Triage → 🔬 Investigator → 🤨 Skeptic → 🛠️ Responder.
The twist? They never talk to each other directly. Each writes its handoff into the graph, and the next one reads it back. 📝
Here’s the login meltdown, solved:
🚀 A deploy hit auth at 13:34
🔴 auth started alerting at 13:38
📱 The mobile backend above it at 13:40: the alerts climbed the path in order ✅
🚩 A feature flag on users sits on the same path, but users never alerted. Rejected. ❌
🧩 A graph algorithm splits the rest of the alerts into three separate problems and links the other two to the incidents they belong to
🛡️ The Evidence Gate: Proven, or It Tells You Why Not
Before any verdict reaches you, it passes 8 named checks, each shown with the exact query that decided it:
📍 Is the suspect actually in the graph?
🛤️ Is it on a call path?
⏱️ Did it fail first?
📈 Do the alerts climb in order?
🧾 Does it explain every alert?
🥊 Does every rival fail a check?
✅ Is every claim backed by the graph?
👀 Did anything fail off the graph?
All eight pass → CONFIRMED 🏆. If the graph can’t connect the failure, it says so instead of guessing. Because no path is not proof of safety. 🙅
🧪 It Proves the Fix Before You Click Approve
The agent can only propose. A human always approves. 👤 But first, Hypocenter applies the fix to a copy of the graph and tells you exactly which alerts it will clear and which it will leave. 🔮
After approval, it checks that the alerts really cleared. If they didn’t? The incident reopens on its own. 🔁
📊 But Does It Actually Work?
I tested it on all 360 real failures in the public RCAEval benchmark, against the benchmark’s own baseline code:
🎯 81%: right service first
🔒 71% on 90 failures I kept locked away while building it. A published method, NSigma, scores 76% there, and I report that loss instead of hiding it. 💯
🪤 94.5–96.8% on planted faults packed with decoys, vs 50% for “blame the latest deploy”
And to prove the graph does the real work: a test for each of the 8 FalkorDB algorithms changes what that algorithm reads and checks that the decision flips. 💪 Pull FalkorDB out entirely? There’s no answer at all.
🏢 It Knows Your Company Too
💬 Ask “why was this change made?” and the answer comes straight from the team’s chat
🧠 Ask “who owns it?” and it remembers what “it” meant
🚦 Before a deploy, it says ship, review or hold, with every reason
🚀 Try It Now
🌐 Live demo: 16-4-94-72.sslip.io (no sign-in, no key)
💻 Code: github.com/rago12bit/grapho1, running with one Docker command
⭐ If your incident tool has ever confidently blamed the wrong deploy, give it a path to walk.
