BUILDING WITH AI / CASE STUDY 01
Warroom.
An AI team that investigates.
And questions its first answer.
Exploring how AI agents can help make sense of a production incident—with evidence, visible progress, and room to challenge an early conclusion.
- PROJECT
- Open-source prototype
- FOCUS
- Multi-agent investigation
- BUILT WITH
- Mozaik · Next.js · TypeScript
01 / THE PROBLEM
The first explanation can be wrong.
A deployment happens. Payments start failing. It is tempting to connect the two immediately. Incident response needs a way to investigate competing explanations while keeping the evidence easy to follow.
Warroom explores that problem through a deliberately misleading payment incident: an apparent deployment issue turns out to be a provider-specific authentication failure.
02 / THE APPROACH
Give the investigation different perspectives.
Four specialists inspect metrics, logs, deployments, and payments concurrently. An investigator develops hypotheses, a skeptic challenges weak explanations, and an incident commander waits for corroborating signals.
The product makes that collaboration visible. A live timeline shows evidence arriving, the leading hypothesis changing, and the reason a false lead was rejected.
Independent specialists
Investigator + skeptic
Commander + report
03 / THE ENGINEERING
Make the AI workflow inspectable.
Mozaik coordinates the agents. Typed events and Zod validation keep their shared state structured, while role-specific tool permissions limit what each participant can do. Server-Sent Events bring the investigation into a Next.js dashboard.
Reports export as PDF and JSON. An evaluation harness checks whether a run creates, challenges, and corrects a hypothesis before reaching a resolution—giving the workflow a testable definition of success.
04 / THE RESULT
A working prototype you can inspect.
The repository includes the dashboard, agent runtime, replayable scenarios, and report exports. It demonstrates a complete path from a question to a reviewable recommendation.
Model-backed runs use a configured provider; without one, a deterministic demo keeps the experience reproducible. Both modes use simulated telemetry. Live monitoring integrations and production impact remain future work.
Explore the source and run instructions