Data Incident Investigator

• 

  Data Incident Investigator product promise, fixture readiness, and four-step read-only investigation contract.

• 

  Seven editable data-incident playbooks with Removed schema column identified as the canonical judge path.

• 

  Evidence-backed verdict: plausible contributor, 81% confidence, four facts, two supported impacts, and bounded execution.

• 

  Schema-validated path: incident → dataset → removed-column fact → top hypothesis → linked impact. Connectors show provenance, not causality.

• 

  Two bounded downstream impacts with evidence provenance, deterministic Markdown export, and the observable investigation activity trail.

Inspiration

Data teams rarely lack evidence during an incident. The problem is that schema changes, lineage, catalog metadata, dashboard dependencies, and ownership are spread across tools. Investigators spend critical time assembling those facts, and an explanation is hard to trust when its supporting evidence is not visible.

What it does

Data Incident Investigator provides seven visible, editable incident playbooks and accepts a focused incident question. The read-only workflow finds bounded context, traces lineage, tests factual evidence, ranks evidence-linked hypotheses with code-owned scoring, and explains only supported downstream impact.

For the canonical Removed schema column fixture, the report labels the leading result a plausible contributor, shows 81% high evidence confidence, links the displayed fact and impact to that top hypothesis, and keeps recommendations Not Executed.

How we built it

The project is a TypeScript pnpm monorepo. React 19 and Vite 7 provide the judge-facing UI. Fastify 5 serves the API and built web application from one same-origin Node.js 24 service. Zod schemas validate incident, provider, execution, confidence, blast-radius, and export contracts. A provider-neutral MetadataAdapter supports deterministic fixtures, direct DataHub GraphQL, and a bounded DataHub MCP Server path.

The real integration path passed a localhost-only proof against DataHub Core 1.6.0 and the official DataHub MCP Server 0.6.0. The Public judge deployment intentionally remains credential-free fixture mode; remote MCP hosting is not claimed.

The MCP path uses the official MCP TypeScript SDK, discovers only read-only search and get_lineage tools, and enforces time, byte, entity, and lineage limits. Deterministic TypeScript orchestration owns ranking and report composition; the current investigation makes zero model calls. The Public fixture runs on Google Cloud Run with only synthetic, process-local data.

Challenges we ran into

• Preserving one report contract across fixtures, direct GraphQL, and an MCP provider with a different supported tool surface.
• Preventing metadata text from becoming instructions while preserving it as quoted evidence.
• Making confidence inspectable without exposing or claiming hidden chain-of-thought.
• Distinguishing complete-within-bounds blast radius from partial, unknown, or unavailable coverage.
• Packaging a public fixture demo with exact runtime and legal provenance without credentials or customer data.

Accomplishments

• Seven editable incident playbooks make the product scope visible before a judge starts.
• One credential-free incident flow reaches a schema-validated report in a few minutes.
• Every ranked hypothesis cites evidence present in the same report.
• Confidence uses visible basis-point factors with exact provenance.
• Blast-radius impacts carry stable URNs, paths, distances, and evidence links.
• The Markdown export is deterministic and sanitized.
• Safe recommendations are review-only and never auto-executed.
• The public Apache-2.0 repository has a published v1.0.1 release and successful exact-main CI.

What we learned

An investigation agent is more useful when uncertainty is a first-class output. Unknown lineage coverage, missing runtime logs, and a plausible contributor are more honest than a confident story without evidence. Deterministic orchestration also makes an agent easier to rehearse, test, and audit even when live metadata inputs can vary.

Current limitations

Only Removed schema column has the rich checked-in browser fixture. MCP recent changes remain unsupported by the official tool surface. Incidents are process-local. Public availability is an owner commitment, not an uptime guarantee. No model call, DataHub write-back, automatic remediation, organizer acceptance, or prize result is claimed.

Built With

• datahub
• node.js
• react
• typescript
• vitest