Free hosting (Render + Firebase), Evidence panel, live problem picker, README

Author: skypank-coder

.firebaserc

@@ -0,0 +1,5 @@
+{
+  "projects": {
+    "default": "specterops-848e3"
+  }
+}

README.md

@@ -54,7 +54,7 @@ cascade across three services — with **94% confidence, in ~0.3s of compute.**
 ## ✨ What's inside
 
 - 🤖 **Four autonomous agents** orchestrated end-to-end, reasoning with **Google Gemini 2.5 Flash**.
-- 🟣 **Live Dynatrace integration** — one click pulls the latest **real open problem** from your tenant and investigates it; the finished RCA can be **pushed back onto the problem as a comment** (closing the loop).
+- 🟣 **Live Dynatrace integration** — **browse all open problems** in your tenant and investigate any one you pick (or auto-grab the latest); the finished RCA can be **pushed back onto the problem as a comment** (closing the loop).
 - 🧪 **Scenario library + custom incidents** — four real-world failure scenarios (missing index, memory leak, bad deploy, dependency outage) plus a **"describe your own"** form.
 - 📡 **Real-time SSE streaming** — every agent's start/finish streams live to the dashboard.
 - 🕸️ **D3 causal graph** + **Three.js** 3D hero + **Framer Motion** — a business-grade UI, not a toy.
@@ -75,7 +75,7 @@ SpecterOps is a pipeline of four specialized agents. Each one does a single job
 hands structured state to the next. Every step streams to the dashboard live over SSE.
 
 ```
-        Dynatrace Alert  (webhook  ·  or  "⚡ Trigger Demo Incident")
+     Dynatrace problem  (live pull · webhook · scenario · custom incident)
                                    │
                                    ▼
    ┌──────────────────────────────────────────────────────────────────┐
@@ -108,8 +108,11 @@ hands structured state to the next. Every step streams to the dashboard live ove
 
 ## 🎬 The demo
 
-> Open the dashboard, click **⚡ Trigger Demo Incident**, and watch the whole diagnosis
-> happen live in ~30–60 seconds.
+> Sign in, then **choose what to investigate** — a **live open problem pulled straight from
+> your Dynatrace tenant**, a built-in failure scenario, or your own typed incident — and watch
+> all four agents diagnose it live in ~30–60 seconds.
+
+**Example — the "missing index" scenario:**
 
 1. 🛡️ SentinelAgent classifies it as a `DATABASE_ISSUE` on `payment-service`.
 2. 🔍 TraceArchaeologist reconstructs a 7-event timeline and surfaces the impact strip:
@@ -119,12 +122,14 @@ hands structured state to the next. Every step streams to the dashboard live ove
    ```sql
    CREATE INDEX CONCURRENTLY idx_payment_methods_user_id ON payment_methods (user_id);
    ```
+5. 🟣 One click **pushes the finished RCA back onto the Dynatrace problem** as a comment.
 
 A live **"Time to Diagnose"** counter proves the speed claim on screen.
 
-> 💡 **Zero-account demo:** with `DEMO_MODE=true` (default), every Dynatrace call returns
-> realistic simulation data. If no `GEMINI_API_KEY` is set, each agent falls back to a
-> scenario-accurate offline response — so the full pipeline always completes end-to-end.
+> 💡 **Runs with zero accounts:** `DEMO_MODE=true` uses realistic simulated telemetry, and
+> without a `GEMINI_API_KEY` each agent uses a scenario-accurate offline response — so the
+> full pipeline always completes. **Add a Gemini key + a Dynatrace token to make it fully
+> real:** live problems, real LLM reasoning, RCA pushed back to Dynatrace.
 
 ---
 
@@ -145,7 +150,7 @@ uvicorn main:app --reload --port 8000
 # 4 — Frontend (new terminal)  → http://localhost:5173
 cd frontend && npm install && npm run dev
 
-# 5 — Open the dashboard and click "⚡ Trigger Demo Incident"
+# 5 — Open the dashboard, sign in, and pick a scenario (or a live Dynatrace problem)
 ```
 
 > For **live Gemini reasoning**, drop a key from [Google AI Studio](https://aistudio.google.com/apikey)

backend/Dockerfile

@@ -4,4 +4,5 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 COPY . .
 EXPOSE 8080
-CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080", "--workers", "1"]
+# Bind the platform-provided $PORT (Render, Cloud Run, etc.); default 8080 locally.
+CMD ["sh", "-c", "uvicorn main:app --host 0.0.0.0 --port ${PORT:-8080} --workers 1"]

backend/agents/blame_agent.py

@@ -82,8 +82,11 @@ async def run_blame_mapper(incident: Incident) -> Incident:
     try:
         raw = await gemini_json(prompt)
         result = _parse_json_safe(raw, offline)
-        if not result.get("nodes") or len(result.get("nodes", [])) < 2:
-            result = offline
+        # Require a proper chain; a 1-node "just the root" graph isn't useful, so
+        # fall back to the richer scenario-built chain.
+        if not result.get("nodes") or len(result.get("nodes", [])) < 3:
+            if len(offline.get("nodes", [])) > len(result.get("nodes", [])):
+                result = offline
     except Exception:
         result = offline
 

backend/mcp/dynatrace_client.py

@@ -89,14 +89,26 @@ async def get_problem_by_id(self, problem_id: str) -> Dict[str, Any]:
         return await self._try_get(f"/api/v2/problems/{problem_id}", fallback={})
 
     async def add_problem_comment(self, problem_id: str, message: str) -> None:
-        """Post a comment back onto a Dynatrace problem (requires problems.write)."""
+        """
+        Post a comment back onto a Dynatrace problem.
+
+        Needs `problems.write` on classic tenants, or the `storage:events:write`
+        platform permission on Grail/Gen3 tenants. On failure we surface
+        Dynatrace's own error message so the cause is obvious.
+        """
         async with httpx.AsyncClient(timeout=15.0) as client:
             resp = await client.post(
                 f"{self.base_url}/api/v2/problems/{problem_id}/comments",
                 headers=self._headers(),
                 json={"message": message, "context": "SpecterOps"},
             )
-            resp.raise_for_status()
+            if resp.status_code >= 400:
+                detail = ""
+                try:
+                    detail = (resp.json().get("error", {}) or {}).get("message", "")
+                except Exception:
+                    detail = resp.text[:200]
+                raise RuntimeError(f"HTTP {resp.status_code}: {detail or 'request failed'}")
 
     async def get_problem_details(self) -> Dict[str, Any]:
         if self.demo:

backend/mcp/scenarios.py

@@ -418,27 +418,46 @@ def build_dynatrace_scenario(problem: Dict[str, Any]) -> Dict[str, Any]:
 
     err, p99 = _parse_impact(evidence + [title])
 
-    ev = evidence[:6]
-    n = len(ev)
+    others = [s for s in services if s != primary][:3]
+    sev_log = "ERROR" if severity in ("CRITICAL", "HIGH") else "WARN"
+    primary_short = primary.split(" in ")[0].split(":")[0].strip()
+
+    # Build a coherent, staged causal chain so the graph and timeline are always
+    # complete — even when a live problem has a single affected entity and one
+    # line of evidence. Stages: (service, description, is_root).
+    stages: List[Tuple[str, str, bool]] = []
+    stages.append((primary, evidence[0], True))
+    for d in evidence[1:4]:  # extra evidence becomes middle stages
+        stages.append((primary, d, False))
+    if len(stages) < 2:       # guarantee a propagation stage
+        stages.append((primary, f"{primary_short} degraded — errors and latency rising", False))
+    if others:                # real downstream services
+        for s in others:
+            stages.append((s, f"Impact propagated to {s}", False))
+    else:                      # synthesize user-facing impact
+        stages.append((f"users of {primary_short}", f"User-facing requests through {primary_short} degraded", False))
+
+    stages = stages[:6]
+    n = len(stages)
     start = 1380
-    step = max(60, (start - 120) // max(1, n))
-    timeline = []
-    logs = []
-    for i, d in enumerate(ev):
-        off = start - i * step
-        timeline.append([off, primary, "evidence", d, severity, i == 0])
-        logs.append([off, "ERROR" if severity in ("CRITICAL", "HIGH") else "WARN", d, primary])
+    step = max(120, (start - 120) // max(1, n - 1)) if n > 1 else 600
 
-    others = [s for s in services if s != primary][:3]
-    nodes = [["node-1", primary, evidence[0], start, True]]
-    edges = []
-    prev = "node-1"
-    for j, s in enumerate(others, start=2):
-        nid = f"node-{j}"
-        nodes.append([nid, s, f"Impacted downstream by {primary}", start - (j - 1) * step, False])
-        edges.append([prev, nid, "cascaded to", 0.85])
+    timeline, logs, nodes, edges = [], [], [], []
+    prev = None
+    for i, (svc, desc, is_root) in enumerate(stages):
+        off = start - i * step
+        etype = "evidence" if i == 0 else ("cascade" if svc != primary else "error")
+        timeline.append([off, svc, etype, desc, severity, is_root])
+        logs.append([off, sev_log, desc, svc])
+        nid = f"node-{i + 1}"
+        nodes.append([nid, svc, desc, off, is_root])
+        if prev:
+            rel = "cascaded to" if svc != primary else "led to"
+            edges.append([prev, nid, rel, 0.86])
         prev = nid
 
+    cascade_chain = list(dict.fromkeys(s for s, _, _ in stages))
+
     explanation = (
         f"Dynatrace flagged '{title}'. The root cause is localized to {primary}"
         + (f", cascading to {', '.join(others)}" if others else "")
@@ -472,7 +491,7 @@ def build_dynatrace_scenario(problem: Dict[str, Any]) -> Dict[str, Any]:
         "analysis": {
             "classification_reasoning": f"Dynatrace problem on {primary}: {title}",
             "first_anomaly": evidence[0],
-            "cascade_chain": [primary] + others,
+            "cascade_chain": cascade_chain,
             "root_cause_category": "OTHER",
             "confidence_pct": 88,
             "root_cause_explanation": explanation,

backend/routes/incidents.py

@@ -37,6 +37,7 @@ def _demo_mode() -> bool:
 class TriggerRequest(BaseModel):
     scenario_id: Optional[str] = "db_index"
     owner: Optional[str] = None
+    problem_id: Optional[str] = None  # specific Dynatrace problem to investigate
 
 
 class CustomIncidentRequest(BaseModel):
@@ -123,20 +124,29 @@ async def trigger_from_dynatrace(body: Optional[TriggerRequest] = None):
         )
 
     client = DynatraceClient()
-    try:
-        data = await client.get_open_problems()
-    except Exception as exc:
-        raise HTTPException(status_code=502, detail=f"Dynatrace API error: {exc}")
-
-    problems = data.get("problems", [])
-    if not problems:
-        raise HTTPException(status_code=404, detail="No open problems found in Dynatrace.")
 
-    problem = problems[0]
-    problem_id = problem.get("problemId") or problem.get("displayId")
+    # A specific problem was chosen from the picker, or fall back to the latest.
+    if body.problem_id:
+        try:
+            full = await client.get_problem_by_id(body.problem_id)
+        except Exception as exc:
+            raise HTTPException(status_code=502, detail=f"Dynatrace API error: {exc}")
+        if not full or not full.get("title"):
+            raise HTTPException(status_code=404, detail="That Dynatrace problem was not found.")
+        problem = full
+        problem_id = body.problem_id
+    else:
+        try:
+            data = await client.get_open_problems()
+        except Exception as exc:
+            raise HTTPException(status_code=502, detail=f"Dynatrace API error: {exc}")
+        problems = data.get("problems", [])
+        if not problems:
+            raise HTTPException(status_code=404, detail="No open problems found in Dynatrace.")
+        problem = problems[0]
+        problem_id = problem.get("problemId") or problem.get("displayId")
+        full = await client.get_problem_by_id(problem_id) if problem_id else {}
 
-    # Fetch the full problem (richer evidence) and build a real-data scenario.
-    full = await client.get_problem_by_id(problem_id) if problem_id else {}
     scenario = scenarios.build_dynatrace_scenario(full or problem)
 
     incident_id = str(uuid.uuid4())
@@ -216,7 +226,11 @@ async def push_rca_to_dynatrace(incident_id: str):
     except Exception as exc:
         raise HTTPException(
             status_code=502,
-            detail=f"Could not post comment (token may lack 'problems.write' scope): {exc}",
+            detail=(
+                "Dynatrace rejected the comment. The token needs 'problems.write' "
+                "(classic) or the 'storage:events:write' permission (Grail/Gen3 tenants). "
+                f"Details: {exc}"
+            ),
         )
     return {"posted": True, "problem_id": incident.dynatrace_problem_id}
 

backend/routes/meta.py

@@ -7,12 +7,16 @@
 
 import storage
 from mcp import scenarios
-from mcp.dynatrace_client import dynatrace_configured
+from mcp.dynatrace_client import DynatraceClient, dynatrace_configured
 from utils.gemini_client import active_model, gemini_available
 
 router = APIRouter(prefix="/api", tags=["meta"])
 
 
+def _demo_mode() -> bool:
+    return os.getenv("DEMO_MODE", "true").lower() in ("1", "true", "yes")
+
+
 @router.get("/config")
 async def get_config():
     """What's actually wired up — used by the dashboard's connection badges."""
@@ -43,3 +47,31 @@ def _slack_configured() -> bool:
 @router.get("/scenarios")
 async def get_scenarios():
     return scenarios.list_scenarios()
+
+
+@router.get("/dynatrace/problems")
+async def list_dynatrace_problems():
+    """List open problems from the live Dynatrace tenant so the user can pick one."""
+    if _demo_mode() or not dynatrace_configured():
+        return {"connected": False, "problems": []}
+
+    client = DynatraceClient()
+    try:
+        data = await client.get_open_problems()
+    except Exception as exc:  # surface, don't crash
+        return {"connected": True, "error": str(exc)[:200], "problems": []}
+
+    out = []
+    for p in (data.get("problems", []) or [])[:25]:
+        services = [e.get("name", "") for e in p.get("affectedEntities", []) if e.get("name")]
+        out.append({
+            "id": p.get("problemId") or p.get("displayId"),
+            "title": p.get("title", "Problem"),
+            "severity": scenarios._DT_SEVERITY.get(p.get("severityLevel", ""), "HIGH"),
+            "severity_level": p.get("severityLevel"),
+            "status": p.get("status"),
+            "services": services[:4],
+            "service_count": len(services),
+            "start_time": p.get("startTime"),
+        })
+    return {"connected": True, "problems": out}

firebase.json

@@ -0,0 +1,18 @@
+{
+  "hosting": {
+    "public": "frontend/dist",
+    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
+    "rewrites": [
+      {
+        "source": "**",
+        "destination": "/index.html"
+      }
+    ],
+    "headers": [
+      {
+        "source": "**/*.@(js|css)",
+        "headers": [{ "key": "Cache-Control", "value": "max-age=31536000,immutable" }]
+      }
+    ]
+  }
+}

frontend/src/components/CTA.jsx

@@ -24,7 +24,7 @@ export default function CTA() {
                 <Zap className="h-4 w-4" /> Launch the live demo
               </a>
               <a
-                href="https://github.com"
+                href="https://github.com/skypank-coder/SpecterOps-Autonomous-Post-Incident-Forensics-Agent"
                 target="_blank"
                 rel="noreferrer"
                 className="btn-ghost"