Skip to main content
Open Investigations from the workspace sidebar. Each row represents an investigation, which may contain several alerts sharing a cause. Active shows running investigations, Needs attention shows failed runs, and Done shows completed runs; All shows every state. New alerts can appear as Collecting while Corvo gathers them for an investigation window.
Investigations list with status filters and alert counts

Each row is an investigation. The alert count shows how many occurrences it contains.

​
Read an investigation

Select a row to open its conversation and details panel. The panel contains:
  • Alerts: grouped occurrences and the individual log entries behind them.
  • Pull requests: PRs recorded for this investigation, when available.
  • Agent summary: the latest result of the agent’s work.
  • Links: a Cloud Logging query for the relevant logs.
Investigation details with seven alert entries, no PR, and a Cloud Logging link

Expand Alerts to inspect individual entries. This example retains seven occurrences; the service URL is hidden.

The conversation shows the investigation’s work and findings. If the message field is available in your workspace, you can ask a follow-up question there; it continues the same investigation. Alerts are assigned before a conversation is available, so a newly collected alert may briefly have no chat. Done means the latest run finished. It does not mean the underlying service has been fixed. An investigation can end with a report, a PR, or a failure. Review the findings and any PR before deciding what to deploy. Alerts created before the investigation view may appear in a separate legacy section. Their past conversation is available for reference, but new follow-ups belong in current investigations.

​
Prepare code access

Connect GitHub and build an Agent environment with the repositories Corvo should use. Corvo may identify a repository from the evidence it reads; it does not require the old Cloud Run service-to-repository binding. The agent’s ability to branch, push, and open a draft PR also depends on Permissions. For the alert path and repeat behavior, see Investigation pipeline and Repeated alerts.