FLAGSHIP PROJECT // 01Actively Developed / Portfolio Project

ResolveIQ

Production Incident Intelligence Platform

Deterministic correlation, autonomous agent investigation, and evidence-backed root cause analysis.

// THE CHALLENGE

The Fragmented Telemetry Crisis

During high-severity production outages, engineering teams are inundated with disconnected metrics, unstructured logs, fragmented traces, and noisy alerts across dozens of microservices. Engineers waste critical minutes manually correlating disparate dashboards while MTTR surges.

Alert storms with hundreds of concurrent notifications obscuring the initial failure point

Siloed telemetry forcing on-call engineers to cross-reference multiple independent tools

Premature LLM adoption producing confident hallucinations without ground-truth verification

Lack of institutional memory resulting in re-solving already resolved historical incidents

// THE ARCHITECTURAL SOLUTION

Deterministic Grounding + Tool-Augmented AI

ResolveIQ unites streaming telemetry with a deterministic detection and graph correlation engine before handing verified signals to a Spring AI investigation agent. The agent synthesizes runbooks via hybrid RAG to generate an evidence-backed Root Cause Analysis — or halts in an explicit INSUFFICIENT EVIDENCE state when telemetry is inconclusive.

High-throughput OpenTelemetry ingestion decoupled through Apache Kafka

Deterministic graph-based correlation engine establishing verified failure topologies

Spring AI investigation agent equipped strictly with read-only observability tools

Hybrid RAG combining pgvector embeddings with BM25 exact keyword matching

Anti-hallucination safety barrier that prefers uncertainty over fabricated causes

// 3D SYSTEM ARCHITECTURE

13-Stage Incident Intelligence Pipeline

From application telemetry ingestion through deterministic correlation, autonomous Spring AI agent tools, to human engineer sign-off.

13-STAGE ARCHITECTURAL PIPELINE // 2D SCHEMATIC

STAGE 1 OF 13

ingestionPACKET TYPE: METRICS

Applications

Containerized Java/Spring Boot and polyglot microservices instrumented with OpenTelemetry SDKs emitting high-volume telemetry.

Key Technical Primitives:

Distributed microservice topologyZero-code instrumentation auto-injectionContext propagation across HTTP/gRPC

SUMMARY: Microservices and distributed applications executing production workloads.

// LIVE INCIDENT SIMULATION

Simulated Incident Lifecycle & Safety Verification

Test how ResolveIQ responds to a simulated database connection starvation incident, or trigger the deliberate Insufficient Evidence safety state.

SIMULATED INCIDENT // PORTFOLIO DEMONSTRATION

All metrics & telemetry are synthetic demonstrations

SYSTEM TOPOLOGY & SIGNAL CONVERGENCE HUDINCIDENT ID: INC-8492-DEMO

Kafka Ingestion

6.4k events/s (Normal)

Detection Engine

Thresholds nominal

Correlation Graph

No active clusters

Evidence Collector

Standby

Spring AI Agent

Dormant

Hybrid RAG Engine

Cache Warm

RAG RETRIEVAL ENGINE// DUAL-PATH HYBRID SEARCH

Dual-Engine Hybrid RAG Retrieval

Standard vector search alone struggles with exact identifier lookups like error codes or table names. ResolveIQ combines pgvector semantic embeddings with BM25 exact keyword matching, merging results via Reciprocal Rank Fusion (RRF).

Incident Query

"HikariPool connection timeout SQLTransientConnectionException"

Correlated Telemetry Signature

Vector SearchPostgreSQL pgvector (HNSW index)

Captures semantic intent, diagnostic narratives, and analogous incident descriptions even when differing terminology is used.

Reciprocal Rank Fusion (RRF) Confluence

Keyword SearchBM25 Algorithm

Guarantees deterministic, exact-token recall for specific exception classes, configuration flags, and service names.

Context Delivery

Spring AI Investigation Agent

Evidence-Grounded Knowledge Injected

// Retrieved Sample Runbooks (Demonstration Data):Ranked by hybrid relevance score

RB-3040.96 RRF Score

HikariCP Connection Pool Exhaustion Playbook

Category: Database Persistence

Matches SQLTransientConnectionException and connection acquisition timeout telemetry.

RB-1180.84 RRF Score

PostgreSQL Client-Side Connection Leak Diagnostics

Category: Infrastructure

Provides validation scripts to verify unclosed JDBC statements.

RB-2090.78 RRF Score

Cascading Microservice Timeout Mitigation

Category: Resilience

Guides circuit breaker trip threshold tuning on payment proxies.

ROOT CAUSE ANALYSIS // RESOLVEDINC-8492-DEMO

Checkout Service HikariCP Connection Starvation

ENGINEER VERIFIED // SIGNED OFF

Confidence ScoreDEMO METRIC

94%HIGH CERTAINTY

Calculated across 8 supporting telemetry streams with 0 contradictory hardware faults.

Severity: SEV-1 (Critical)

// Synthesized Diagnostic Root Cause

A misconfigured configuration change (commit #a9c14f) reduced the HikariCP max-pool-size from 50 to 10 while transaction timeout was inadvertently increased to 45s, causing fast pool starvation under concurrent loads.

Affected Services:

checkout-service (Origin)payment-proxyorder-orchestrator

// Supporting Evidence Streams

HikariCP active connections reached 100% capacity (pool_size=10/10) for 180s

Connection acquisition timeout rate spiked from 0.01% to 84.2%

p99 HTTP latency elevated from 42ms to 4,820ms on POST /api/v1/checkout

// EVALUATED COUNTER-EVIDENCE

Hypotheses challenged and ruled out during agent cross-examination to eliminate confirmation bias:

✕Database host PostgreSQL instance CPU utilization remained nominal at 18%

✕Direct DB health check responded within 2ms — PostgreSQL was not unresponsive

✕Network packet loss across DB VPC remained flat at 0.00%

// RECOMMENDED MITIGATION ACTION

Revert application configuration commit #a9c14f or dynamically set 'spring.datasource.hikari.maximum-pool-size=50' via actuator refresh endpoint.

Runbook Execution: Ready for on-call engineer dispatchStatus: Validated

Demo visualization — values are illustrative, not measured production data.

TECHNOLOGY STACK// COMPLETE PRODUCTION SUITE

Categorized Architectural Stack

// FRONTEND

Next.js (App Router)ReactTypeScriptTailwind CSSFramer MotionThree.js / R3F

// BACKEND

JavaSpring BootREST APIsSpring MVC

// MESSAGING

Apache Kafka (Event-driven telemetry ingestion)

// TELEMETRY

OpenTelemetry (OTLP collector, traces, metrics, logs)

// DATABASES

PostgreSQLRedispgvector

// RAG & AI

Spring AIpgvector Vector SearchBM25 Keyword SearchReciprocal Rank Fusion

// SECURITY

OAuth2 / OIDCJWTRBACRow-Level Security (RLS)Argon2idTLS

// TESTING

JUnitTestcontainersVitestE2EChaosLoad Testing

// CONTAINERIZATION

DockerDocker Compose

ENGINEERING RATIONALE// ARCHITECTURAL TRADE-OFFS

Key Systems Decisions & Justifications

Why Apache Kafka for telemetry ingestion?

Decision: Buffered partitioned messaging stream

Production incidents generate sudden 100x spikes in telemetry volume (error logs, retries, traces). Direct HTTP ingestion would overwhelm analytical databases. Kafka guarantees backpressure handling, ordered partitions, and asynchronous decoupling at scale.

Production Rationale Verified

Why deterministic detection precedes the AI agent?

Decision: Rule and statistical pre-filtering before LLM involvement

Letting an LLM 'guess' correlation across millions of raw events produces hallucinations and massive token waste. A deterministic engine computes p99 anomalies and graph traversal first, grounding the AI agent strictly in verified signals.

Production Rationale Verified

Why hybrid vector + BM25 retrieval?

Decision: pgvector semantic embeddings paired with BM25 exact matching

Semantic embeddings excel at conceptual queries ('db connection starvation') but often misrank precise tokens like 'SQLTransientConnectionException' or specific error codes. Hybrid RAG provides both conceptual discovery and exact-token precision.

Production Rationale Verified

Why are investigation agent tools strictly read-only?

Decision: Zero mutation privilege during diagnosis

Automated agents diagnosing an active outage must never have write access to mutate clusters, restart services, or modify schemas without explicit human engineer verification, preventing catastrophic cascading failures.

Production Rationale Verified

SECURITY MODEL// ZERO-TRUST ARCHITECTURE

Enterprise Zero-Trust Security

Every telemetry stream, API request, and data storage tier is secured following defense-in-depth principles.

OAuth2 / OIDC

Identity federation with enterprise identity providers.

Cryptographic JWTs

Stateless, signed bearer tokens for distributed microservice authorization.

Role-Based Access Control (RBAC)

Granular separation between incident viewers, responders, and leads.

Row-Level Security (RLS)

PostgreSQL tenant isolation ensuring multi-tenant telemetry segregation.

Argon2id Key Derivation

State-of-the-art password hashing resilient against GPU/ASIC attacks.

End-to-End TLS

Encrypted transport for OTLP streams, Kafka broker connections, and API endpoints.

VERIFICATION & RELIABILITY// COMPREHENSIVE TEST SUITE

Testing Strategy & Chaos Validation

Reliability is engineered from unit test thresholds up to high-throughput load and fault injection.

JUnit 5

Java / Spring Boot

Unit validation of detection algorithms, statistical thresholds, and correlation graph traversal logic.

Automated Pipeline Stage

Testcontainers

Dockerized PostgreSQL & Kafka

True integration testing with real Kafka brokers, pgvector indexing, and SQL transactions.

Automated Pipeline Stage

Vitest & React Testing Library

Frontend UI & State

Component rendering, simulation state machine transitions, and accessible keyboard focus.

Automated Pipeline Stage

Chaos Engineering

Simulated Fault Injection

System resilience during Kafka partition unavailabilities and downstream telemetry dropouts.

Automated Pipeline Stage

Load Testing

High-Throughput Generators

Ingestion throughput under 50,000 telemetry events per second without collector memory leaks.

Automated Pipeline Stage