What does the root-cause agent receive when the triage agent hands off crash loops?

Tares gives the root-cause agent the triage finding for the crash-looping entity, introduced by a line such as Handed off by triage with verdict “investigate” on service=checkout. It does not receive the raw logs. The agent starts on that same entity and pulls any further evidence with its own tools. The triage agent must end its runs with the conclude tool, because the verdict comes from there.

How it works

A handoff is three values: a verdict, the agent that takes over, and a cooldown. When a triage run ends with a finding whose verdict matches the handoff (case does not matter), Tares starts the target agent on the entity the finding is about.

For a crash loop, the flow looks like this:

• The triage agent runs on its schedule and sees that one entity, for example service=checkout, looks like it is crash looping.
• It ends its run with the conclude tool and a finding with the verdict investigate. The finding is recorded on that entity and names the numbers that moved.
• Tares matches the verdict to the handoff and starts the root-cause agent on the same entity.
• The root-cause agent is handed the finding, after a line such as Handed off by triage with verdict "investigate" on service=checkout.
• It then fetches any further evidence itself. With the setup from Watch, then escalate, it uses read, stats and any MCP tools you give it, and writes its note on the same entity with conclude.

The verdict only exists because of conclude. An agent that does not end its runs with a conclusion has no verdict to match, so no handoff fires. The triage preset ticks Ends every run with a conclusion for you and lists investigate as a verdict, and Tares holds the agent to it: every run ends with conclude, or the result goes back to the agent to fix.

The run is recorded with woken_by: handoff and the triage run as its parent.

Set it up

This setup sits in the AI SRE pattern: a cheap agent watches, and a thorough one explains.

1. Put your sources and both agents in one project. Add a schedule trigger such as watch-web over the source that carries your crash-loop signal, and label the fields you want counted.
2. Create the triage agent on that trigger. Seed its prompt from the Triage (on a schedule) preset, which ticks Ends every run with a conclusion and lists the verdict investigate.
3. Create the root-cause agent in the same project. Seed its prompt from Root cause after a handoff and set its trigger to No trigger: only a handoff starts it.
4. Open the triage agent. Under When it concludes, choose Add a handoff, pick investigate from the verdict dropdown, pick the root-cause agent, and keep the cooldown at 30m.
5. Or declare both agents in the catalog:

agents:
  - name: triage
    trigger: watch-web
    concludes: true
    verdicts:
      - { verdict: investigate, when: one entity looks like a problem and needs a closer look }
    prompt: |
      ...
    handoffs:
      - { verdict: investigate, agent: rca, cooldown: 30m }
  - name: rca               # no trigger: it runs only when handed off
    prompt: |
      ...

The verdict field also accepts any word you type. If a handoff names a verdict the agent never gives, the form warns you that the handoff would never run.

What you get

• A focused starting point. The root-cause agent begins with the triage finding and the entity it names, so it does not have to search for what to look at.
• Evidence on demand. It reads what it needs with its own tools instead of working from a pasted pile of lines.
• One thread. On the project’s Activity, the handed-off run sits under the triage run, so the crash-loop finding and the root cause read as one chain. The Overview shows one card for the whole chain.
• Bounded cost. At most one handoff from triage to that agent happens per entity within the cooldown. A handoff inside the cooldown starts no run, and the finishing run’s results say handoff to rca skipped: cooldown.
• No silent drops. If the target is already running for that entity, or has hit its daily cap or budget, the handoff is recorded as a capped run with the reason.
• A depth limit. Chains stop at depth 3. After three handoffs in a row, the next is recorded as a capped run with the error handoff chain stopped at depth 3.
• The target runs regardless of its own trigger. Give it no trigger when it should run only after a handoff.

When something else fits

Use a trigger over the findings source instead when you need a condition, such as several investigate findings in a window or findings from more than one agent. Pick one link or the other, not both, or the root-cause agent runs twice per flag. See Hand off to another agent for the full rules.

Related