Aftershock

Aftershock is an incident commander that remembers how previous outages were resolved. It turns a live production signal into a cautious action plan, records the outcome, and makes that experience available to the next on-call engineer.

This repository was started on July 22, 2026 for the CockroachDB × AWS Agentic Memory Hackathon.

Why memory is the product

Runbooks describe ideal systems. Incident memory describes the system that actually failed. Aftershock stores structured incident state and a vector embedding in the same CockroachDB transaction. A new incident first searches for semantically similar resolved incidents, then ranks actions by both similarity and repeated success. No historical match is treated as proof: the agent always exposes confidence and risk.

Architecture

• CockroachDB distributed vector indexing: cosine search over 64-dimensional incident embeddings, prefixed by service for precise and scalable recall.
• CockroachDB Agent Skills: the schema and query layer is audited with the official cockroachdb-sql skill; the pinned source revision and applied rules are recorded in docs/cockroachdb-skill-audit.md.
• AWS Lambda: receives incident events and runs the commander as a stateless compute layer while CockroachDB remains the durable system of record.
• Local demo mode: deterministic embeddings and in-memory storage keep tests and the public demo usable without cloud credentials or paid services.

Run locally

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
uvicorn aftershock.api:app --reload

Open http://127.0.0.1:8000. Without DATABASE_URL, the app uses a seeded, zero-cost demo memory. Set DATABASE_URL to a CockroachDB connection string to use durable vector recall.

Run the tests

python -m pytest

The tests exercise recall, action ranking, timeline updates, and memory writeback.

Demo video

The editable Remotion source is in demo-video/. Run npm install once, then npm run still for a representative frame or npm run render for the complete 81-second H.264 video. Rendered media stays untracked in demo-video/out/.

Data model

The production schema is in sql/schema.sql. It stores active incident state, the full event timeline, and resolved memories. It uses CockroachDB's VECTOR(64) type and a cosine-optimized vector index with service as a prefix column.

Security posture

• Recommendations are evidence-linked and carry confidence and risk.
• The agent defaults to observation or reversible actions.
• Database credentials are accepted only through environment variables.
• Schema creation remains an explicit deployment step rather than an API action.
• No secrets, raw credentials, or customer payloads are written to logs.