A Qwen-powered alert-to-remediation autopilot with a mandatory approval-record gate.

Short description

Praxis turns a signed operational alert into a Qwen-generated diagnosis and remediation plan, pauses at a mandatory approval checkpoint, and executes only the approved action. In the intended demo the owner performs that approval visibly. Provider/model evidence and successfully recorded plan, approval, and tool-result entries appear in one auditable incident timeline; a fallback transition appears only when that incident actually used one.

Inspiration

Every on-call engineer knows the 3am alert for a failure the team has diagnosed before. The expensive part is rarely receiving the alert; it is rebuilding context under pressure, deciding what is safe, and proving afterward why a change was made.

Praxis asks a practical question: can an agent shorten that loop without turning operational automation into an uncontrolled actor? The answer is an autopilot with a hard approval-record gate—not a system that silently changes infrastructure.

What it does

Praxis accepts HMAC-signed webhook alerts and normalizes them into incidents. Same-key deliveries deduplicate while the incident process survives, and unauthenticated request bodies are bounded before parsing. The caller-supplied idempotency header is not yet bound into the body signature or independently normalized/bounded, and neither incidents nor deduplication authority are cross-instance durable. The application launches a Qwen agent task that classifies the signal, performs thinking-mode root-cause analysis, calls registered read tools, and produces a strictly validated remediation plan with per-step risk and rollback information. The working tree supports that post-response flow on one provisioned non-idle controller under a one-running/three-pending FIFO and fixed deadlines; the current deployment cannot claim it until the live capacity probe passes.

The plan stops in AWAITING_APPROVAL. The state machine cannot enter EXECUTING until the bearer-authenticated single-operator boundary records an immutable Approval within the process-local incident store. The UI holds the operator token in page memory only, requires a second native confirmation for approve, and discards the token on reload. Function Compute replacement can still clear the process-local record, so durable operator authorization remains future hardening. The safe state-changing action can target only the dedicated disposable Alibaba Function Compute demo service; caution and dangerous tools use visibly labeled dry-run adapters. Rejecting or editing a plan sends concrete feedback back through Qwen for regeneration without crossing the execution boundary.

The incident page exposes every successfully recorded decision-trail entry: classification, reasoning summary, tool calls, provider/model selection, the proposed plan, the human decision, and execution results. Fallback entries appear only for transitions that occurred; a post-dispatch audit failure can leave the external tool outcome uncertain rather than fabricating a complete trail.

How we built it

The backend is Python 3.10 with FastAPI, deployed as an Alibaba Cloud Function Compute 3.0 web function. The interface is a dependency-free HTML/CSS/JavaScript timeline served by the same function.

All product-runtime model calls are restricted to Qwen-family models. Praxis starts with Qwen Cloud Model Studio in every environment. Routine classification uses qwen-flash; deeper reasoning starts with qwen3.7-max and can continue through the verified Qwen model chain. When an eligible authentication, quota, availability, server, or timeout failure occurs, the client records the transition and can use the same Qwen family through OpenRouter. Per-attempt and logical-call deadlines bound network work and keep fallback reachable when the process is running; they do not guarantee that ordinary Function Compute will continue a coroutine after the webhook response.

The tool registry separates reads from writes and validates model-produced arguments against strict schemas. The one real write adapter is exact-target allowlisted to an isolated disposable Function Compute service. Every other state-changing target remains a labeled simulation. Structured logs and API responses carry trace IDs, while secrets stay in environment or cloud-injected credentials.

The deployed memory path uses an Alibaba Tablestore table and vector search index with a 1024-dimensional Float32 embedding field. Praxis implements the text-embedding-v4 contract, a best-effort resolve-time write attempt, triage-time nearest-neighbor recall, tests, and the memory-match API. The Function Compute controller receives temporary credentials through a dedicated table-scoped execution role. A prior in-instance schema smoke verified live metadata/schema access; it did not execute a Search or prove recurrence recall. The hardened standalone proof now additionally requires an exact Qwen sentinel, the complete schema, and matching live FC model/version/trace markers; do not claim its strict result until the owner-authorized rerun passes. Current memory text is plan-derived rather than verified-execution-derived, and a transient failure is not retried durably. The evidence also does not yet prove that a fresh owner-approved resolution wrote a row and that a distinct recurrence recalled it; those application-level steps remain open.

Challenges

The hardest engineering problem was not generating a plan; it was making the boundary around that plan trustworthy. Model output is untrusted, so Praxis validates structure, tool names, arguments, risk policy, and rollback text before it can become actionable. Approval is also a server-side state transition, not a UI convention.

Provider resilience created another constraint. Exhausting multiple model attempts with long network timeouts could outlive Function Compute itself. We therefore bounded each complete attempt and the logical route, preserving enough time to reach the same-Qwen fallback and record what happened.

Finally, a credible real action needed isolation. Restarting the Praxis controller would couple the demo to its own remediation target. A second disposable Function Compute service gives the real adapter something honest to change without risking unrelated workloads.

Accomplishments we are proud of

An Alibaba Cloud deployment with a browser-safe HTTPS domain; the linked URL currently serves the last authorized revision rather than every local hardening change.
Qwen-only runtime enforcement with Qwen Cloud first and same-Qwen fallback visibility.
Signed, size-bounded webhook intake with process-local same-key deduplication and fast acknowledgement.
A code-enforced, bearer-authenticated single-operator Approval invariant before every state-changing action; multi-user identity remains outside v1.
Strict tool and plan validation, explicit rollback text, and labeled dry-run behavior.
A dedicated, exact-allowlisted Function Compute remediation target.
A deployed Tablestore memory path with schema, embedding, role, best-effort write/recall code, API, and automated-test coverage; execution-grounding, durable delivery, and final application-level write-and-recall evidence remain pending.
A broad automated regression suite; the current post-deadline local tree passes 697 tests with one tracked dependency deprecation warning. Rerun immediately before any permitted publication because later changes can invalidate the count.

What we learned

Agent safety becomes easier to explain when it is represented as state, not prose. AWAITING_APPROVAL → EXECUTING is permitted only when the approval record is written atomically in the process-local incident store. The same principle applies to model routing: provider fallback is more credible when each recorded attempt and actual transition is visible in the incident trail.

We also learned to distinguish build-time assistance from product runtime. Codex running GPT-5.6 Sol helped develop and test Praxis, but the application itself calls Qwen-family models only. That separation is enforced by configuration validation and tests.

Judging-criteria mapping

Innovation & AI Creativity: Qwen thinking-mode reasoning, native tool schemas, correction cycles, and visible same-Qwen provider fallback.
Technical Depth & Engineering: Alibaba Function Compute deployment, bounded signed intake with process-local deduplication, strict plan/tool validation, a tested approval-gated state machine, isolated real execution, and a deployed Tablestore vector-memory path with explicitly bounded remaining proof.
Problem Value & Impact: a shorter, safer path from an operational alert to an accountable remediation for small on-call teams.
Presentation & Documentation: a problem-first demo, visible decision trail, architecture diagram, Apache-2.0 source, deployment proof, and technical build article.