On-call incident copilot

Forty alerts. One incident.

Salvo clusters your alerts, proposes the root cause, and drafts the runbook.

P0 · INC-23412m 44s ago
Checkout 500s spiked — checkout-api
42 alerts clustered · checkout-api
TOP CAUSE · 92%
checkout-api@v412 deploy introduced a regression
runbook · 4 steps · rollback queued
42 → 1
Alerts collapsed per incident
3m 10s
Median to top-cause proposal
0
Commands the agent runs itself
92%
Top-cause hit rate on replay
The 3 AM problem

A page at 3 AM is not a problem statement. It is a symptom of a system telling you forty things at once.

Most of those forty are downstream of the one that matters. On-call spends the first ten minutes de-duping Slack channels, pulling up dashboards, and asking the same question: which deploy broke this? Salvo answers it first, in writing, with evidence.

The workflow
  1. 01
    Ingest.
    Prometheus, Datadog, Grafana, or plain webhook. No agent to install; no sidecar to inject.
  2. 02
    Cluster.
    Temporal + service + label correlation. 42 alerts → 1 incident, not 42 PagerDuty pages.
  3. 03
    Hypothesize.
    Every candidate cause has an evidence path on the graph. Salvo never picks silently.
  4. 04
    Draft.
    A runbook, confidence-scored. Every mitigation step is copy-to-clipboard; the agent never executes.
  5. 05
    Sign.
    Signed timeline + postmortem stub. You write the narrative; Salvo owns the scaffolding.
Three things only Salvo does

Graph-first, not alert-first.

A cause without an evidence path is not a cause. The traversal is shown to you so you can disagree in public.

Confidence on every step.

Top-cause and runbook both carry a score. Salvo flags the ones it would pause before running.

Copy, do not execute.

The agent drafts kubectl. You paste it. A human is always in the loop.

Made for
  • The rotating on-call

    One of eight in the rotation. First ten minutes set the tone. Salvo makes the first ten minutes a read, not a triage.

  • The SRE lead

    Reads postmortems on Monday. Wants the scaffolding standard and the narrative human.

  • The founder-engineer

    No dedicated on-call yet. Every page goes to the same phone. Salvo is the first responder that keeps that phone usable.

“The first ten minutes used to be: open six tabs, join three channels, ask who deployed. Now it is: read one page.”

— Maya A. · SRE lead · <internal replay · not a customer>
Questions
Does Salvo auto-resolve incidents?
No. The agent never closes an incident and never runs kubectl. It drafts a runbook; a human runs each step.
Which alert sources are supported?
Prometheus, Datadog, Grafana, and plain HTTP webhooks at v0.9. PagerDuty and Opsgenie integrations are tracked in /changelog.
How does the graph get built?
From your service-mesh + deploy-pipeline metadata. Salvo does not guess — services must already publish dependency edges somewhere.
What happens on a low-confidence top cause?
Salvo still proposes a runbook but marks the step confidence below 60% in warn-amber. The operator is expected to pause before running.
Is it safe for production?
Salvo is in alpha. See /security for the honest list of what is and is not hardened.
Start

Read the next incident before standup.