Inspiration
Small IT teams investigate incidents across noisy server logs and loosely related helpdesk tickets. IncidentOps Starter provides a reusable local foundation that keeps evidence visible and treats AI output as a hypothesis for a person to inspect.
What it does
Two distinct applications share one Python/FastAPI skeleton. Linux Log Investigator accepts UTF-8 logs, preserves line IDs and presents explicit diagnostic signals with source evidence. Helpdesk Ticket Investigator accepts CSV/JSON tickets, groups signals, highlights missing information and proposes questions and a general response draft.
The model proposes a category and evidence IDs. Each non-unknown claim must cite records submitted to the model containing an explicit matching signal; unsupported or malformed claims fall back to unknown. An operator accepts or rejects each finding and acknowledges review before JSON export. Editing the input invalidates the result. No commands run and no systems or tickets are modified. This is a review workflow, not a signed audit trail.
How we built it
Two FastAPI entrypoints share normalization, best-effort redaction, context selection, validation and review. A llama.cpp server runs Qwen3-1.7B Q8 locally on CPU, offline and on loopback, without paid APIs or cloud inference. Inputs are bounded; omitted records are visible. Redaction is best-effort, so sanitize real data before loading.
How Kiro was used
Kiro IDE Auto helped develop requirements, acceptance scenarios, architecture and a candidate evidence validator. We reviewed the proposal and strengthened the signal gate and submitted-subset validation. The root .kiro directory contains steering, requirements, design and tasks. Codex implemented and tested the app. We do not claim Kiro authored all code or that its candidate was already tested.
Challenges and learning
During preflight the small model sometimes produced plausible but unsupported diagnoses or malformed evidence IDs. This led to explicit signal checks, unknown fallback and human review. On small synthetic tests the baseline achieved 11/12 correct categories and 9/12 strict category-and-evidence results; six new cases achieved 5/6. These are not production accuracy claims. The guarded MVP passed 26 automated tests, real local-model/API checks and both browser review flows.
Try it
The public walkthrough replays four saved synthetic model/API results; it is not live inference. For full functionality, follow the repository README on Windows with Python 3.11, run the explicit setup_local_model.py downloader for pinned official artifacts with SHA-256 verification, then run python run.py both. No login or paid API is required for local operation.
What's next
Broader evaluation with sanitized real-world records, improved evidence extraction and unknown handling, and comparison with larger models. Automatic remediation and severity assignment are out of scope.
Existing resources and AI disclosure
The application was created October 31, 2026 during the submission period. Python, FastAPI, Uvicorn, Pydantic, llama.cpp and pretrained Qwen weights are third-party resources retaining their licenses. Kiro and Codex assisted development; Qwen runs locally. Demo inputs are synthetic. The video uses locally synthesized narration with a previously designed synthetic voice; no real person was cloned.
