What does the root-cause agent receive when the triage agent hands off a disk filling up?

Tares hands the root-cause agent the triage finding about the disk filling up, not the raw logs, and starts it on the entity that finding is about. The finding follows a line such as Handed off by triage with verdict "investigate" on service=checkout. The root-cause agent fetches any further evidence itself with its tools. The triage agent must end its runs with the conclude tool, because the verdict comes from there.

How it works

A handoff is three values: a verdict, the agent that takes over, and a cooldown. When a triage run ends with a finding whose verdict matches (case does not matter), Tares starts the target agent. For a disk filling up, that means the following.

• The finding. The root-cause agent is handed the triage finding about the disk, after the Handed off by triage with verdict ... line. It reads the verdict and the numbers triage recorded.
• The entity. The run starts on the entity the finding is about, so the root-cause note lands on the same timeline as the triage finding.
• No logs or metrics attached. The root-cause agent fetches further evidence itself with its tools, such as read, stats and any MCP tools you give it. It decides what else to look at for the disk.
• The verdict comes from conclude. The triage agent must end its runs with a conclusion. A run that ends with no finding hands nothing off.

The target runs whether or not it is on for its own trigger. Give it no trigger when it should run only when handed off. The run belongs to the project whose wiring holds the handoff.

This is the second half of the pattern in Watch, then escalate: a cheap triage agent looks often, and a thorough agent takes the one entity that needs a closer look. It sits in front of the alert-driven agent described in AI SRE.

Set it up

1. Create the triage agent on your schedule trigger, tick that it ends every run with a conclusion, and list a verdict it can give. The example below uses investigate, described as one entity that looks like a problem and needs a closer look. You can type any word as the verdict, and the handoff matches it.
2. On the triage agent, open When it concludes and choose Add a handoff. Pick the verdict, the agent that takes over, and a cooldown. The cooldown is 30m by default.
3. Create the root-cause agent in the same project with no trigger, so only a handoff starts it. Write its prompt to tell it to fetch its own evidence for the disk with its tools and to finish with conclude.
4. Save both agents. In the catalog the wiring looks like this:

agents:
  - name: triage
    trigger: watch-web
    concludes: true
    verdicts:
      - { verdict: investigate, when: one entity looks like a problem and needs a closer look }
    prompt: |
      ...
    handoffs:
      - { verdict: investigate, agent: rca, cooldown: 30m }
  - name: rca               # no trigger: it runs only when handed off
    prompt: |
      ...

5. Check the wiring on the project’s page. Each agent shows its handoffs in both directions. If a handoff names a verdict the agent never gives, the form tells you, because that handoff would never run.

The handoff list holds at most 10 handoffs per agent, and each verdict and agent pair appears once. An update that leaves handoffs out keeps them, and an empty list clears them.

What you get

• The root-cause agent starts on the same entity as the triage finding, with the finding in hand, so you do not need a second trigger in between.
• The handed-off run is recorded with woken_by: handoff and the finishing run as its parent. On the project’s Activity the triage finding and the root cause read as one thread.
• At most one handoff from triage to the root-cause agent per entity within the cooldown. A handoff inside the cooldown starts no run, and the finishing run’s results say handoff to rca skipped: cooldown.
• Nothing is dropped silently. If the target is already running for that entity, or has hit its daily cap or budget, the handoff is recorded as a capped run with the reason.
• Chains stop at depth 3. After three handoffs in a row, the next is recorded as a capped run with the error handoff chain stopped at depth 3.
• If you delete the target agent, the handoffs that point to it are removed, and the delete response lists the agents under handoffs_removed_from.

When something else fits

• If you need a condition before waking the root-cause agent, such as several findings in a window or findings from more than one agent, use a trigger over the findings source instead. Watch, then escalate shows it. Use one link or the other, not both, or the root-cause agent runs twice per flag.
• If the agent that watches does not end its runs with conclude, there is no verdict to match, so a handoff cannot start.

Related