Should I escalate from triage to the root-cause agent with a handoff or a trigger over findings?

Tares escalates from triage to the root-cause agent best with a handoff on the triage agent, which is the simpler fit. A trigger over the findings source, filtered to the triage agent’s investigate findings, is worth it only when you need a condition such as several findings in a window or findings from more than one agent. Use one link or the other, not both, because both make the main agent run twice per flag.

How it works

In the watch-then-escalate pattern, a triage agent runs on a schedule trigger and ends every run with a conclusion. Most runs end with no finding. When one entity looks off, the run ends with a finding carrying the verdict investigate. The main agent then does the root-cause analysis on that same entity. You choose how the main agent wakes up:

• Handoff. You add it on the triage agent under When it concludes. When triage concludes with investigate, the main agent takes over on the same entity. The main agent needs no trigger of its own: you set it to No trigger: only a handoff starts it, so it never wakes by itself.
• Trigger over findings. A trigger reads the findings source, filters to the triage agent’s investigate findings and applies a condition. The main agent runs on that trigger. This is the route when the wake-up depends on a condition, such as several investigate findings in a window or findings from more than one agent.

The main agent receives the triage finding, not the raw logs. It fetches its own evidence with read, stats and any MCP tools you give it, then writes its note on the same entity with conclude.

Tares refuses two trigger shapes. An agent can be woken by findings only through a trigger filtered to another agent’s findings (agent eq <name>). A trigger over all findings, or over the agent’s own findings, is refused, because the agent would wake itself forever.

Set it up

1. Build the triage side first: a schedule trigger over your sources, then a triage agent on it with the verdict investigate. The full walk-through is in Watch, then escalate.
2. Create the main agent in the same project and seed its prompt from the Root cause after a handoff preset. It comes with the verdicts rca and resolved.
3. For the simpler route, add a handoff on the triage agent. Pick investigate from the verdict dropdown, pick the main agent and set the cooldown to 30m. Leave the main agent with no trigger.

agents:
  - name: triage
    trigger: watch-web
    concludes: true
    verdicts:
      - { verdict: investigate, when: one entity looks like a problem and needs a closer look }
    prompt: ...             # from the Triage (on a schedule) preset
    handoffs:
      - { verdict: investigate, agent: rca, cooldown: 30m }   # at most two root-cause runs per hour per entity
  - name: rca               # no trigger: it runs only when handed off
    concludes: true
    verdicts:
      - { verdict: rca, when: you found what is failing and why }
      - { verdict: resolved, when: it was noise, or it is already over }
    prompt: ...             # from the Root cause after a handoff preset

4. If you need a condition instead, skip the handoff and add a trigger over the findings source. Filter it to the triage agent’s investigate findings:

triggers:
  - name: escalate
    sources: [findings]
    key_field: service
    filters:
      - {field: agent, op: eq, value: triage}
      - {field: verdict, op: eq, value: investigate}
    condition: {aggregate: count, predicate: "> 0", window: 5m}
    cooldown: 30m    # at most two root-cause runs per hour per entity

5. Create the main agent on escalate, enable it and seed its prompt from Root cause after a handoff. Raise the count in the predicate if you want several findings in the window before the main agent wakes.
6. Check that only one link exists. If the triage agent has a handoff and the main agent also runs on escalate, remove one of them.

What you get

• One clear escalation path from a cheap, frequent triage agent to a thorough, rare main agent.
• With a handoff, the link shows on the triage agent’s page under When it concludes, so you see in one place where a flag goes.
• With a trigger, a condition decides when the main agent wakes, such as several findings in a window.
• A cooldown of 30m on either link, so the main agent runs at most twice per hour per entity.
• One root-cause run per flag, because you use a single link.
• A chain you can follow end to end. The tick, the triage finding and the root cause appear in order, and the Overview shows them as one card under What the agents found.

To stop the watch, disable the triage agent or pause its schedule trigger. With no new investigate findings, the main agent goes quiet too.

When something else fits

• Choose the handoff when one investigate finding is enough reason to start a root-cause run. This is the default for most setups.
• Choose the trigger over findings when you need a condition, such as several findings in a window or findings from more than one agent. Remember it must filter to another agent’s findings, never all findings or the agent’s own.
• If you want alert-driven investigation instead of a scheduled first level, see Build an AI SRE.

Related