SREGym replaced an incident-investigating LLM agent with a programmatic Kubernetes evidence collector and Jev choices. The collector reads objects, logs, events, and resource usage, summarizes candidate components, then gathers focused evidence. Jev selects a likely source and supporting observations; ordinary code assembles the report. Jev does not generate diagnostic commands or write the report.

What the study found

  • SREGym reports 80 judged passes in 105 diagnoses, over 21 historical faults repeated five times. All five attempts passed for 16 faults and all five failed for five faults.
  • The team reports a 14.6-second median end-to-end diagnosis, versus 0.53 seconds of summed Jev API latency per attempt. The rest is not model time.
  • Its $0.15 total Jev inference estimate uses TypeSafe’s published prices; it excludes the engineering, data collection, and other operating costs. None of these results was independently reproduced for this capture.
  • A GPT-6 Astra judge scored submitted reports against SREGym’s rubric at a 0.70 threshold. This is judged diagnosis quality, not a verified production incident fix or a direct measure of Jev alone.

The instructive cases

  • Webhook success: a live Pod had a 16Mi memory limit against 256Mi in its Deployment template. The collector found a matching admission webhook; Jev chose the component and the evidence showing the mismatch. All five submissions passed.
  • Wrong clue: for an expensive request-filter regex, Jev consistently favored a CPU-limit change shown alongside it. The judge rejected all five causal explanations.
  • Missing clue: a queue-and-retry feedback loop crossed two services, but the collector omitted retry and queue metrics, and Jev had to pick a single root-cause component. All five attempts failed.

The reusable lesson is about the interface between evidence gathering and bounded judgment. A typed choice can make a report consistent; it cannot recover a metric that was never collected or turn the wrong causal clue into a correct diagnosis. The pipeline implementation is linked by the authors; this capture analyzes the article, not a rerun of the pipeline.