Distributed Trace Anomaly Triage and Incident Remediation Chain
Architect an agent workflow chain that ingests distributed telemetry, correlates microservice latency, and outputs root-cause playbooks.
Apply this framework when building automated observability agents to investigate production SLO regressions across microservices. It systematizes telemetry ingestion, causal dependency traversal, and automated mitigation planning.
Role: Principal Distributed Systems Architect specializing in observability and autonomous incident response.
Context
- Microservice Topology: {{microservice_topology}}
- Telemetry & Tracing Stack: {{telemetry_stack}}
- Service Level Objective Breach Profile: {{slo_breach_profile}}
- Agent Orchestration Engine: {{agent_orchestrator_engine}}
- Parallel Execution Concurrency Limit: {{concurrency_limit}}
Task
Architect an automated workflow chain utilizing {{agent_orchestrator_engine}} that analyzes distributed trace anomalies during a {{slo_breach_profile}} incident across {{microservice_topology}}, leverages {{telemetry_stack}} for root-cause isolation, and outputs a validated remediation plan respecting {{concurrency_limit}}.
Method
- Define the telemetry ingestion node to query spans, latency histograms, and error metrics from {{telemetry_stack}}.
- Design the topological correlation agent that traverses upstream and downstream dependency graphs of {{microservice_topology}}.
- Formulate the anomaly isolation node to isolate anomalous span attributes, database locks, or resource saturation points.
- Construct the hypothesis evaluation agent chain running parallel diagnostic queries up to {{concurrency_limit}}.
- Specify the causal graph reconstruction mechanism to rank potential root causes with confidence scoring.
- Detail the remediation synthesis agent to map root causes to pre-approved runbook actions or configuration rollbacks.
- Define safety validation gates to verify that proposed mitigations do not induce cascading failures across dependent services.
Constraints
- MUST enforce read-only access for all exploratory diagnostic queries executed by agents.
- MUST NOT trigger active remediation actions without satisfying deterministic confidence criteria (>90%).
- Graph traversal algorithms MUST terminate within predefined timeout limits to prevent circular dependency deadlocks.
- All agent trace analyses must produce human-auditable causal dependency paths.
Output format
- Telemetry Ingestion & Correlation Architecture (data flow diagram & query contracts)
- Agent Chain State Machine & Tool Matrix (node definitions, inputs, context retention, tool schemas)
- Safety and Concurrency Policy (rules enforcing {{concurrency_limit}} and query throttling)
- Incident Diagnostic & Remediation Output Template (structure for root cause analysis and action plan)
Self-review
- Ensure the workflow handles missing or corrupted distributed trace spans gracefully.
- Confirm that parallel hypothesis validation strictly respects {{concurrency_limit}}.
- Check that every remediation step maps to safe, deterministic operational parameters.
Explicit role, a named task, and discrete steps the model can follow.
Background, inputs and variables the model needs before it starts.
Hard boundaries — what the model must and must not do.
A named, field-level shape for the response.
Ordered work items that force analysis before an answer.
Length and structure that travel across frontier models.
Signal density — instruction weight without padding.
Documented variables so the scaffold adapts to new inputs.
Quality bar, assumptions and behaviour when inputs are thin.
How much real usage the template has behind it.