Building an autonomous multi-agent SRE in a weekend (Gemini + ADK on Google Cloud)

Gunnam Sai Saketh Ram — Mon, 31 Aug 2026 17:49:52 +0000

I built this project, AegisOps, for the All Things Agentic Hackathon.

Every SRE knows the 3am page. An alert fires, and you're half-awake triaging, digging through logs, guessing which deploy broke prod, then writing the postmortem. I wanted to see if a team of agents could do that whole loop — autonomously, but safely.

What it does

When a production alert lands, six specialized agents run in sequence under one orchestrator:

Triage — severity, affected service, blast radius.
Diagnosis — summarizes the error logs, and reads the actual Grafana dashboard screenshot with Gemini vision to confirm the anomaly. This multimodal step was the one that surprised me most — feeding a real dashboard image and getting back an accurate read of the spike.
Correlation — scores recent deploys by time-proximity and names a probable root cause with a calibrated confidence.
Memory — cosine-similarity search over fingerprints of past incidents.
Remediation — proposes a reversible fix, then halts for human approval.
Comms — auto-writes the RCA, posts a PII-scrubbed card to Slack, files a ticket.
The tech
Google ADK for the multi-agent orchestration (LlmAgent + Runner).
Gemini 3.5 Flash for the five fast agents, Gemini Pro for the heavier RCA reasoning — both on Vertex AI.
Firestore for state, memory, and the full audit trail.
Pub/Sub for event-driven alert ingestion.
Cloud Run to deploy it all in one container.
The lesson: governance > model

The hard part wasn't prompting. It was making the system trustable. The remediation executor is never exposed to the model as a callable tool — the LLM can plan a rollback, but the destructive action physically cannot fire until a human clicks Approve (an async gate, not a polled flag). Every agent step — input, reasoning, tool call, tokens, latency — is streamed live and persisted to an audit log.

That, plus a 503-safe retry wrapper on every model call, is what turns a demo into something that behaves like production.

It learns

On resolution, the incident's fingerprint + confirmed cause + effective fix gets written back to memory. Next time that pattern appears, the Memory agent recalls it instantly. A novel incident reads as "novel"; a repeat is recalled with the known fix.

Live app: https://aegisops-kjacopurja-uc.a.run.app Code: https://github.com/Sak3th2004/Aegisops

Built solo for #AllThingsAgenticHackathon.

DEV Community: Gunnam Sai Saketh Ram

Building an autonomous multi-agent SRE in a weekend (Gemini + ADK on Google Cloud)