"IncidentFlow's 8-step loop: EVENT→DETECT→ROUTE→INVESTIGATE→DECIDE→HUMAN APPROVAL→ACT→LOG. Nothing escalates without human sign-off."
"A real escalation awaiting review — 42 tickets vs an 18.0 baseline (2.33x), brief drafted by Gemini. Nothing moves without human approval."
"Same escalation after approval — decision, reviewer, and timestamp written to the audit trail, closing the loop from decision to record."
"Confirming the service is live on Cloud Run, not local — gcloud describe returns the public URL and True for active traffic."
"Public repo: detect.py, decide.py, approve.py, act.py, Dockerfile, README — built by Team Cloud Catalyst (Edmund + Nandini)."

Inspiration

Support teams drown in ticket noise during real incidents — by the time someone notices a spike and writes it up for the right team, the delay itself becomes part of the incident. We wanted an agent that watches ticket volume continuously, recognizes when something's actually abnormal (not just busy), and gets a clear brief in front of a human fast — without skipping the human.

What it does

IncidentFlow follows one loop: EVENT → DETECT → ROUTE → INVESTIGATE → DECIDE → HUMAN APPROVAL → ACT → LOG. It watches ticket volume per category, scores it against a rolling historical baseline, and flags WATCH/ALERT tiers when the ratio crosses a threshold. For anything abnormal, Gemini 3.5 Flash drafts a short, fact-grounded incident brief and a recommended escalation target. A human reviewer approves or rejects — only then does anything get logged as escalated. Every step, including the human's decision, is written to Firestore as a permanent audit trail.

How we built it

• DETECT (detect.py): pulls recent ticket counts per category, compares against an 8-window rolling average stored in Firestore's incident_events collection, and classifies NORMAL / WATCH / ALERT. • DECIDE (decide.py): feeds the scored event to Gemini 3.5 Flash with a system prompt that restricts it to reasoning only from the given figures — no invented root causes — and returns a 2–4 sentence brief plus a recommended escalation target. • Data model: three Firestore collections — tickets_raw (inbox), incident_events (scoring history), escalation_decisions (the human-reviewed audit log, with decision/reviewed_by/reviewed_at populated only after a person acts). • Stack: Gemini 3.5 Flash via the google-genai SDK, Google Cloud Firestore, Google Cloud Run for hosting, Python throughout.

Challenges we ran into

Keeping the human-approval step genuinely blocking rather than cosmetic — it would have been easy to let the agent "recommend and move on," but the design deliberately halts at escalation_decisions until a person sets decision. Also constraining Gemini's brief to only the numbers it was given, so it doesn't hallucinate ticket content or root causes it was never shown.

What we learned

Building the audit-trail collection first (before the agent logic) made the human-in-the-loop boundary much easier to enforce — the schema itself makes it obvious where automation stops and review starts.

What's next

Wire investigate.py (pull similar past incidents for context before drafting the brief), build the approval UI, and deploy the full loop to Cloud Run.