Autonomous Bug Investigation and Resolution Agent

basis · Tech · 2026 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Incident response and bug investigation

Basis needed to automate on-call bug investigation as incident volume grew, while producing evidence-backed summaries that engineers could verify and trust.

Constraints:

• routine investigations should complete quickly, while complex investigations may run for over an hour
• the agent needs access to logs, database/query tools, the monorepo, runbooks, and documentation
• long-running investigations suffer from context compaction and early stopping
• tool interfaces that work in short sessions can compound confusion over hundreds of turns
• adoption requires integration into Slack incident workflows, not just a standalone chat UI

Architecture

Basis built Clueso, a debugging agent running in a Modal VM with the Claude Agent SDK. Clueso can query logs and data, navigate the monorepo, read runbooks and product docs, save tool outputs to local files, maintain a progress logbook, and produce a post-event summary with timeline and evidence table. The team improved it through known-root-cause evals, self-diagnostic failure analysis, tool-interface iteration, filesystem workflows, prompt-defined done criteria, and Slack integration for incident threads.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  slack-integration[Slack integration] --> clueso-agent[Clueso agent]
  clueso-agent --> modal-vm[Modal VM]
  modal-vm --> claude-agent-sdk[Claude Agent SDK]
  clueso-agent --> monorepo[Monorepo]
  clueso-agent --> logging-service[Logging service]
  clueso-agent --> database-query-tool[Database query tool]
  clueso-agent --> runbooks-and-documentation[Runbooks and documentation]
  logging-service --> evidence-files[Evidence files]
  database-query-tool --> evidence-files
  evidence-files --> progress-document[Progress document]
  progress-document --> post-event-summary[Post-event summary]
  post-event-summary --> engineering-team[Engineering team]
  engineering-team --> slack-integration

Components

Data flow

An engineer or support thread invokes Clueso from Slack or another entry point. Clueso reads the thread as context, runs shell/Python and query tools in its Modal VM, pulls logs, inspects code and docs, stores detailed tool outputs as files, updates a progress document with hypotheses and ruled-out causes, and finally replies with a timeline and evidence table linking back to logs and sample queries.

Why this architecture

Clueso needed a full filesystem and tool environment because bug investigation is long-horizon knowledge work involving logs, queries, code, runbooks, and documentation. Filesystem-backed evidence and a progress logbook prevent compaction from erasing facts or reasoning. Slack integration was added because incident work already happened in Slack, and structured evidence tables gave both humans and the agent a clear definition of done.

Models used: Claude Agent SDK · Clueso

Scale

• Clueso resolves more than 78% of incidents on the first pass.
  “Clueso now debugs more than 78% of incidents on the first pass, allowing our engineers to respond faster and allocate time to higher leverage efforts.”article, stated
• Routine issues resolve in under five minutes.
  “Routine issues resolve in under five minutes. Complex investigations can run for over an hour. Clueso now debugs more than 78% of incidents on the first pass, allowing our engineers to respond faster and allocate time to higher leverage efforts.”article, stated
• Complex investigations can run for over an hour.
  “Complex investigations can run for over an hour. Clueso now debugs more than 78% of incidents on the first pass, allowing our engineers to respond faster and allocate time to higher leverage efforts.”article, stated
• Long investigations can involve dozens of tool calls and potentially hundreds of turns.
  “‍Over the course of an investigation, Clueso makes dozens of tool calls across potentially hundreds of turns.”article, stated
• The team describes the first 60% of capability as quick and the remaining 40% as the hard work.
  “The first 60% of capability comes quickly. The remaining 40% is where the real work begins. ## Verification is easier than generation”article, stated

Alternatives considered (roads not taken)

Open-ended debugging from day one

Rejected because: The team first used known-root-cause bugs so failures pointed to missing capabilities instead of ambiguous task difficulty.

Manual auditing of every agent failure

Rejected because: Clueso itself diagnosed gaps, generated clarifying questions, and routed them to the right person.

Rely only on context-window memory

Rejected because: Detailed tool results and conclusions were lost or distorted by compaction.

Standalone chat interface

Rejected because: Most incident collaboration already happened in Slack, so Clueso needed to meet users there.

Patterns

context-compaction (memory)

Clueso saves tool results to local files and maintains a progress document so long investigations survive compaction.

agent-memory (memory)

The progress document stores hypotheses, ruled-out causes, evidence links, and next steps across the investigation.

tool-use-orchestration (agentic)

Clueso coordinates monorepo navigation, log pulls, database queries, shell/Python work, runbooks, and documentation.

structured-output-contract (reporting)

Clueso's final answer must contain a timeline and evidence table linking logs and queries.

observability-tracing (operations)

The Claude Agent SDK provided observability hooks, and the team collected sample trajectories to identify tool and reasoning failures.

human-in-the-loop-gate (operations)

Engineers use Clueso's verifiable summaries and product-doc reasoning in Slack threads rather than accepting opaque diagnoses.

Tradeoffs

Use filesystem-backed investigation state

Chose local evidence files and a progress document over keeping all results and reasoning only in model context.

Rationale: Filesystem artifacts preserved raw evidence and conclusions across compaction and long trajectories.

Use known-root-cause bugs for development

Chose verification of confirmed diagnoses over open-ended investigation during early capability building.

Rationale: Known answers made missing tools or product knowledge easier to identify when Clueso failed.

Meet engineers in Slack

Chose Slack/Pylon thread integration over a separate Clueso chat interface.

Rationale: Incident collaboration already happened in Slack, so integration made Clueso visible and easier to adopt.

Gotchas (what bit them)

Tool-interface rough edges compound over long trajectories.

Root cause: Tools that can be worked around in short tasks become sources of cascading confusion across many turns.

Resolution: Basis collected trajectories, asked Clueso to self-reflect on failures, and restructured tools to eliminate footguns.

Context compaction erased details and conclusions.

Root cause: Long investigations generated too many tool outputs and intermediate findings to keep reliably in working context.

Resolution: Clueso saved tool results to files and maintained a researcher-style progress document.

The agent stopped early with speculative answers.

Root cause: As context filled, Clueso sometimes ended before gathering all required evidence.

Resolution: The prompt explained automatic compaction and defined done as a complete evidence-backed timeline.

Technical capability did not automatically create adoption.

Root cause: A standalone chat interface did not fit where engineers already collaborated on incidents.

Resolution: Basis integrated Clueso into Slack/Pylon threads and later triggered it automatically in natural support channels.

Evaluation

Basis evaluated Clueso with known-root-cause bugs, trajectory analysis, first-pass bug resolution, routine/complex runtime observations, and adoption outcomes after Slack integration.

Metrics: more than 78% of incidents debugged on first pass · routine issues in under five minutes · complex investigations over an hour · dozens of tool calls across potentially hundreds of turns · capability development framed as first 60% quick, remaining 40% hard

Outcomes

• Clueso resolves more than 78% of incidents on first pass.
• Routine investigations can finish in under five minutes.
• Slack integration increased usage and visibility.
• Engineers get evidence-backed post-event summaries rather than opaque conclusions.

The article reports percent resolved and runtime classes but not total incident count, invocation volume, or API cost.