Cortex : AI Bug Triage & Incident Operator

Inspiration

Anyone who maintains a busy repo — open source or a fast-moving product team — knows the quiet tax of bug triage. A report lands. Someone has to read it, decide if it's even a real bug, guess how bad it is, figure out who touched that code last, and make sure it doesn't silently rot in the backlog. Multiply that across dozens of developers and hundreds of issues, and triage becomes a full-time job that nobody actually owns.

We kept seeing the same failure modes: severity graded differently depending on who's on call, the "who owns this?" question bouncing around Slack for an hour, and P1s that got acknowledged by no one because the first alert was buried. Triage is high-stakes, repetitive, judgment-heavy work — exactly the kind of thing an agent should handle, if you give it the right guardrails. So we built an operator that does the boring 80% and hands the human the 20% that genuinely needs a decision.

What it does

Cortex is an AI incident-response operator for engineering teams. Point it at a repo, throw a messy bug report at it, and it runs the whole triage pipeline end to end:

• Triages & scores — an agent reads the raw report, decides if it's a real bug, and scores severity P1/P2/P3 with a written rationale.
• Suggests a fix — a second agent drafts a concrete fix: the change, the risk, the effort.
• Finds the likely owner — it reads recent commits and CODEOWNERS on GitHub to point at who most likely broke it, then (with your approval) assigns and comments on the issue.
• Opens & escalates incidents — P1s fire an urgent alert; if nobody acks, a scheduled sweep re-pages until someone does. No more silent P1s.
• Proposes a fix PR — when it's low-risk and high-confidence, it opens a proposal PR. It never silently edits your code.
• Compiles release notes — on demand, it reads everything triaged and writes a clean changelog.

Everything a human shouldn't blindly trust — assigning, acking, opening PRs — is gated behind a click in the live operator board. The agent proposes; the human disposes.

How we built it

Cortex is built entirely on Lemma, an open-source SDK for agentic apps that we came across right before the hackathon and immediately fell for. Its core idea fit our problem perfectly: agents do judgment, functions do deterministic rules, and workflows orchestrate the two. That's exactly the shape of triage — you want the LLM scoring severity, and you absolutely don't want it deciding, non-deterministically, whether to write to your database or open a PR.

The whole product is a Lemma pod bundle — plain declarative files you import with one command:

• 10 tables — issues → bugs → fixes → incidents, release_notes, plus per-user config tables protected with row-level security, so it's multi-tenant from day one.
• 4 agents — triage, fix-suggester, release-notes-writer, and a Slack router — each with a structured output_schema and least-privilege permission grants.
• 20 functions — the deterministic muscle: persistence, GitHub owner-suggestion / assign / auto-PR, incident open/ack/escalate/resolve, and Slack + Jira intake.
• 6 workflows + 2 schedules — one workflow chains the whole intake → triage → fix → persist → owner → incident → auto-PR pipeline; a schedule re-pages unacked P1s automatically.
• 1 live app — the cortex-board operator UI.

We chose Lemma specifically because a 2-day hackathon rewards infrastructure you don't have to build — auth, tables, an agent runtime, scheduling, and a deploy target all came out of the box, so we spent every hour on the actual triage logic instead of plumbing.

Challenges we ran into

• A brand-new SDK. Lemma is powerful but young, and its bundle contract is strict — folder names must equal resource names, every table a function touches must be explicitly granted, system columns are auto-injected. We read the CLI's schema commands closely to get the contract exactly right instead of guessing.
• termios on Windows. The Lemma CLI imports a Unix-only module and crashes instantly on native Windows. We worked around it with WSL for real runs and a shim for offline validation — but it cost us a chunk of day one.
• Drawing the trust boundary. The hardest question wasn't technical, it was "what is the agent allowed to do on its own?" We kept moving actions across the auto / human-gated line until it felt genuinely safe to hand to a real team.
• Keeping agents deterministic enough to persist. Free-form LLM output doesn't store cleanly. A structured output_schema on every agent, plus Python functions for every write, is what made the pipeline reliable instead of flaky.

Accomplishments that we're proud of

• A real end-to-end loop — one command turns a raw report into a scored bug, a suggested fix, a likely owner, and an incident, with no hand-holding.
• A safety model we'd actually trust — nothing that mutates your repo happens without a human click; auto-PRs are proposals; escalation assumes the first page failed.
• Genuine breadth on the SDK — 10 tables, 4 agents, 20 functions, 6 workflows, 2 schedules, and a live app: Lemma as real infrastructure, not a thin wrapper.
• A live, clickable operator board, not just a CLI demo.

What we learned

• The judgment/rules split is the whole game in agentic apps. The moment we stopped asking the LLM to do deterministic work and gave it only decisions, everything got more reliable.
• Guardrails are a feature, not a tax. "The agent proposes, the human disposes" became the most compelling part of the demo, not a limitation.
• Declarative infra is a superpower on a deadline — describing tables, agents, and workflows as files and importing them let us iterate in minutes.

What's next for Cortex : AI Bug Triage & Incident Operator

• Harden the write paths — exercise assign, auto-PR, escalation, and Slack alerts against a live writable repo end to end.
• Duplicate detection — embed each incoming report and surface likely duplicates before triage even starts.
• More intake surfaces — first-class Slack, email, and Jira connectors so reports flow in from wherever your team already lives.
• Learning from overrides — feed human corrections (severity changes, reassignments) back so the triage agent sharpens over time.
• Team analytics — MTTR, escalation rates, and hot-spot files straight off the incident tables.

Built With

• agents
• lemma
• lemma.work
• python
• sdk