File size: 4,568 Bytes
f7d58be
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
# LogSentinel v2 — Demo Script

## 5-Minute Hackathon Demo

### Setup (1 min)

```bash
# Clone and start server
git clone https://github.com/YOUR_USERNAME/logsentinel
cd logsentinel
pip install -r requirements.txt
uvicorn server:app --host 0.0.0.0 --port 7860
```

### Part 1: Environment Overview (1 min)

```bash
# Check health
curl http://localhost:7860/health
# → {"status": "healthy"}

# List available tasks
curl http://localhost:7860/tasks | python -m json.tool
# Shows: log_classification, incident_detection, full_triage,
#        soc_warroom_easy/medium/hard, adaptive_curriculum
```

### Part 2: Multi-Agent Episode (2 min)

**Start a hard SOC war-room scenario:**
```bash
curl -X POST http://localhost:7860/reset \
  -H "Content-Type: application/json" \
  -d '{"task_name": "soc_warroom_hard", "seed": 42}'
```

*Show the response:*
- Agent role: `incident_commander`
- Phase: `detect`
- Logs are role-filtered (only sees sources relevant to IC role)
- `shared_board` is empty (no handoffs yet)

**DB SRE detects replication lag:**
```bash
curl -X POST http://localhost:7860/step \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "action_type": "propose_incident",
      "agent_role": "db_sre",
      "incident_type": "outage",
      "evidence_indices": [17, 18, 19]
    }
  }'
```

**DB SRE hands off to IC:**
```bash
curl -X POST http://localhost:7860/step \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "action_type": "request_handoff",
      "agent_role": "db_sre",
      "handoff_to": "incident_commander",
      "handoff_note": "Replication lag 15.2s on pg-replica-1. WAL 256MB behind. Recommend read query failover immediately."
    }
  }'
```

**Show the shared board is updated:**
```bash
curl http://localhost:7860/state | python -m json.tool
# Shows: shared_board with handoff_1 entry
```

**IC assigns severity:**
```bash
curl -X POST http://localhost:7860/step \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "action_type": "assign_severity",
      "agent_role": "incident_commander",
      "incident_type": "outage",
      "severity": "P1"
    }
  }'
```

**Execute mitigation:**
```bash
curl -X POST http://localhost:7860/step \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "action_type": "execute_mitigation",
      "agent_role": "app_sre",
      "mitigation_id": "failover_read_queries_to_primary",
      "evidence_indices": [17, 18, 19, 20]
    }
  }'
```

**Submit joint report:**
```bash
curl -X POST http://localhost:7860/step \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "action_type": "submit_joint_report",
      "agent_role": "incident_commander",
      "report": {
        "incidents": [
          {"type": "outage", "severity": "P1", "description": "DB replication lag cascade"}
        ],
        "severity": "P1",
        "summary": "Cascading outage from DB replication lag. Read queries failed over to primary. Service health restored."
      }
    }
  }'
```

### Part 3: Reward Breakdown (1 min)

```bash
curl http://localhost:7860/state | python -c "
import json, sys
state = json.load(sys.stdin)
rb = state['reward_breakdown']
print('--- REWARD BREAKDOWN ---')
print(f'R_outcome:          {rb[\"r_outcome\"]:.3f}  (×0.40)')
print(f'R_detection_f1:     {rb[\"r_detection_f1\"]:.3f}  (×0.20)')
print(f'R_severity_acc:     {rb[\"r_severity_accuracy\"]:.3f}  (×0.15)')
print(f'R_efficiency:       {rb[\"r_efficiency\"]:.3f}  (×0.10)')
print(f'R_teamwork:         {rb[\"r_teamwork\"]:.3f}  (×0.15)')
print(f'Penalties:          {rb[\"penalty_spam\"]+rb[\"penalty_unsafe\"]:.3f}')
print(f'TOTAL:              {rb[\"total\"]:.3f}')
"
```

### Key Talking Points

1. **Partial observability**: Each agent role sees different logs — DB SRE sees postgres, Security Analyst sees nginx + WAL
2. **Phase lifecycle**: Detect → Triage → Mitigate → Verify → Final Report (not step-count based)
3. **Composable rewards**: 5 components with weights, all logged for RLVR training
4. **Anti-hacking**: Unsafe mitigation (no evidence) gets penalised; spam proposals reduce F1
5. **Curriculum**: `adaptive_curriculum` task auto-adjusts difficulty based on rolling success rate
6. **Deterministic**: Same seed → same episode (fully reproducible)

## Running Tests

```bash
pytest tests/ -v
```

## Running Baseline Eval

```bash
python training/eval_baseline_vs_trained.py \
    --mode baseline \
    --tasks soc_warroom_easy soc_warroom_medium soc_warroom_hard \
    --episodes 50 \
    --plot
```