TraceCase

Inspiration

Production incidents are a bad place to learn incident response for the first time. Engineers need a safe way to practice reconstructing timelines, separating facts from assumptions, testing hypotheses, and defending a root cause before they are under real operational pressure.

What it does

TraceCase is an interactive production-incident investigation simulator. Investigators work through multiple synthetic cases using realistic timelines, logs, metrics, code, and evidence artifacts.

The investigator must reconstruct what changed, pin relevant evidence, write a falsifiable hypothesis, connect facts into a causal chain, and submit a root-cause verdict with a safe remediation.

GPT-5.6 acts as a Socratic investigation partner. It asks one concise question at a time instead of revealing the answer. When the investigator submits a verdict, GPT-5.6 returns a structured review covering the causal mechanism, supporting evidence, and remediation.

How we built it

TraceCase uses Next.js and React for the investigation workspace, Prisma and SQLite for accounts and saved progress, and the OpenAI Responses API with GPT-5.6 Terra for coaching and verdict review.

The incident artifacts and causal facts are deterministic. AI is used only where judgment adds value: challenging reasoning and evaluating the final explanation. Verdict reviews use strict Structured Outputs so the application receives a validated score, strengths, missing elements, and the next learning step.

Codex was used throughout the build to turn the investigation concept into a runnable product, trace interaction flows, implement authentication and persistence, refine the evidence workspace, validate edge cases, and perform browser-based visual QA.

Challenges

The hardest part was keeping each case internally consistent across the timeline, logs, metrics, code, evidence board, and AI evaluation while still leaving enough ambiguity for the investigator to reason independently.

Accomplishments

A complete end-to-end investigation flow rather than a static prototype.
Three synthetic incident cases with independent saved progress.
An evidence-first interface with timeline, logs, metrics, code, hypotheses, and causal connections.
A one-day isolated demo account with no registration required.
GPT-5.6 coaching that does not leak the canonical answer.
Structured verdict grading grounded in each incident's facts.

What is next

The next step is expanding the catalog across distributed systems, databases, concurrency, observability, networking, and security, with skill scoring derived from repeated investigations.

All incident data in this hackathon build is synthetic and created specifically for the TraceCase demo.