What does the root-cause agent receive when the triage agent hands off slow database queries?

Tares gives the root-cause agent the triage finding for the slow database queries, not the raw data. The finding comes after a line such as Handed off by triage with verdict “investigate” on service=checkout. The agent runs on the entity the finding is about and fetches any further evidence itself with its tools. The triage agent must end its runs with the conclude tool, because the verdict comes from there.

How it works

A handoff is three values: a verdict, the agent that takes over, and a cooldown. When a triage run ends with a finding whose verdict matches, Tares starts the target agent. Case does not matter in the match.

For slow database queries, the target receives these things:

• The finding. It carries the verdict and the numbers the triage agent named, for example which values grew in the last window.
• A leading line. The finding follows a line of the form Handed off by triage with verdict “investigate” on service=checkout. It names the handing agent, the verdict and the entity.
• The same entity. The run starts on the entity the finding is about, so the root-cause note lands on the same timeline.

The target does not receive the logs or rows behind the finding. It pulls more evidence on its own with read, stats and any MCP tools you give it. If the slow queries show up in a Postgres table, a log stream or a metric, the root-cause agent decides what to look at and fetches it.

The verdict comes from the conclude tool. A triage agent that does not end its runs with a conclusion has no verdict to match, so nothing is handed off. Tick Ends every run with a conclusion on the agent and list the verdicts it can give. A run that finds nothing ends as no_op and hands nothing off.

The handed-off run is recorded with woken_by: handoff and the finishing run as its parent. On the project’s Activity it sits under the triage run, so the triage finding and the root cause read as one thread.

Set it up

1. Put the triage agent and the root-cause agent in one project. Give the triage agent a schedule trigger that watches the sources where slow queries would appear, as described in Watch, then escalate.
2. On the triage agent, tick Ends every run with a conclusion and list the verdict investigate.
3. Create the root-cause agent with no trigger, so it runs only when handed off. Seed its prompt from Root cause after a handoff, which comes with the verdicts rca and resolved.
4. Open the triage agent, choose Add a handoff under When it concludes, pick investigate, pick the root-cause agent and keep the cooldown at 30m.
5. Or declare it in the catalog:

agents:
  - name: triage
    trigger: watch-web
    concludes: true
    verdicts:
      - { verdict: investigate, when: one entity looks like a problem and needs a closer look }
    prompt: |
      ...
    handoffs:
      - { verdict: investigate, agent: rca, cooldown: 30m }
  - name: rca               # no trigger: it runs only when handed off
    prompt: |
      ...

6. Make the root-cause prompt tell the agent to gather its own evidence about the slow queries, since the handoff carries only the finding.

The full set of rules is on Hand off to another agent. It is part of the wider AI SRE setup.

What you get

• A root-cause run that starts from a short, readable finding instead of a wall of query logs.
• A root-cause note on the same entity as the triage finding, so one timeline tells the whole story.
• At most one handoff from triage to the root-cause agent per entity within the cooldown. With 30m, that is at most two root-cause runs an hour per entity. A handoff inside the cooldown starts no run, and the finishing run’s results say handoff to rca skipped: cooldown.
• No silent drops. If the target is already running for that entity, or has hit its daily cap or budget, the handoff is recorded as a capped run with the reason.
• A bounded chain. After three handoffs in a row, the next is recorded as a capped run with the error handoff chain stopped at depth 3.
• A project Activity view where the tick, the triage finding and the root cause appear as one thread.

When something else fits

• If you need a condition before escalating, such as several investigate findings in a window or findings from more than one agent, use a trigger over the findings source instead. Use one link or the other, not both, or the root-cause agent runs twice per flag.
• If the triage agent does not conclude with a verdict, there is nothing to hand off. Fix its How it ends settings first.

Related