Nova — Intelligent Incident Triage

Nova — Intelligent Incident Triage with Cloudflare Clef AI

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady.

What I Built

Nova is an AI-powered incident triage platform that turns operational alerts into structured, actionable incident classifications.

When a production alert arrives, engineers often need to determine its severity, identify the responsible team, and decide whether it requires immediate attention. Doing this manually for every alert takes time and can delay incident response.

Nova automates this initial triage process using Cloudflare Clef AI and LangChain. It analyzes an incident's title, description, affected service, environment, source, and metadata to produce a structured classification.

Key features

• AI-powered severity classification: Categorizes incidents as low, medium, high, or critical.
• Intelligent team assignment: Recommends the payments, backend, database, or platform team.
• Urgency assessment: Converts an AI-generated urgency score into a boolean decision using a configurable threshold.
• Structured outputs: Extracts typed AI responses and validates the resulting classifications.
• Input validation: Uses Zod to validate incident payloads before processing.
• REST API: Provides endpoints for health checks and incident triage.
• Error handling: Handles malformed JSON, invalid inputs, missing configuration, and upstream AI failures.
• Modular architecture: Separates AI integration, triage logic, shared schemas, and API handling into dedicated packages.

Nova is designed as a foundation for incident-management workflows. Its recommendations can help engineers prioritize incoming alerts, while the actual incident response remains under human or downstream system control.

Demo

The ideal demo walks through submitting a production incident, validating the request, running AI-powered classification, and inspecting the resulting severity, recommended team, urgency, and reasoning.

Code

GitHub repository: https://github.com/yogesh201sits/nova

Nova is built with TypeScript and Bun in a modular monorepo.

The repository separates the main responsibilities into packages:

• @nova/api — HTTP endpoints and request handling.
• @nova/clef — Cloudflare Clef AI integration.
• @nova/triage — Incident classification orchestration.
• @nova/shared — Shared types and validation schemas.

This structure keeps the AI provider integration independent of the API layer and makes it easier to extend the classification pipeline.

How I Built It

Nova combines Cloudflare Clef AI, LangChain's RunnableLambda, Hono, Zod, TypeScript, and Bun.

1. Cloudflare Clef AI for classification

Cloudflare Clef AI acts as the classification engine. Instead of relying exclusively on manually defined keyword rules, Nova sends incident context to the model along with the classification criteria.

The integration requests three types of answers:

Task	Output	Purpose
Severity classification	Choice	Determines incident severity
Team assignment	Choice	Recommends a responsible team
Urgency assessment	Numerical score	Helps determine whether immediate attention is needed

Where provided, the choice responses include confidence information.

This approach lets Nova evaluate the incident context rather than simply mapping individual keywords to predetermined categories.

2. LangChain RunnableLambda for orchestration

I used LangChain's RunnableLambda to encapsulate the custom Clef integration behind a reusable runnable interface.

It handles the provider-specific inference call and keeps that implementation separate from the core triage logic.

This separation makes the pipeline easier to maintain and leaves room for future changes to the underlying AI integration.

3. Structured result extraction

AI output needs to be converted into predictable application data before other services can consume it.

For example, a team classification may look like this:

{
  "type": "choice",
  "choice": "payments",
  "confidence": 0.8831
}

Nova extracts the selected team, validates it against the supported categories, and maps the result into its incident response schema.

The same process extracts the severity choice and urgency score. Urgency is then evaluated against a configurable threshold:

urgent = urgencyScore >= URGENCY_THRESHOLD;

The current threshold is 0.5.

Keeping extraction and validation separate from inference means the application does not have to trust raw model responses as final application data.

4. Hono and Zod for the API

Hono provides the HTTP API, while Zod validates incoming incident payloads and enforces consistent data structures.

The main endpoints are:

Health check

GET /health

Returns the API's health status.

Incident triage

POST /incidents/triage
Content-Type: application/json

Example request:

{
  "title": "Checkout service outage",
  "description": "Payment requests are failing.",
  "source": "Application monitoring",
  "service": "checkout",
  "severity": "medium",
  "environment": "production",
  "metadata": {}
}

The API validates the request, invokes the triage pipeline, and returns a structured incident result.

An illustrative response might contain:

{
  "data": {
    "incidentId": "example-incident-id",
    "severity": "critical",
    "team": "payments",
    "urgent": true,
    "summary": "checkout: Checkout service outage",
    "reasoning": "Critical severity detected. Immediate investigation is recommended.",
    "status": "open",
    "createdAt": "2026-10-15T04:40:00.000Z"
  }
}

This is an illustrative response, not a claim that every incident produces these values. Actual classifications depend on the supplied context and model output.

5. A modular TypeScript architecture

Bun workspaces provide the monorepo foundation, while TypeScript keeps the application logic type-safe.

The architecture separates provider communication from classification logic and HTTP handling. That separation makes it possible to evolve the API, refine classification rules, or introduce additional integrations without tightly coupling every part of the system.

A Next.js interface is also part of the technology stack for submitting incidents and viewing their classifications.

Why Does Open Innovation Matter?

Open innovation makes it easier to experiment with AI-powered infrastructure without building every component from scratch.

For Nova, the combination of Cloudflare's AI tooling, LangChain's composable interfaces, Hono, Zod, and TypeScript made it possible to build a complete classification pipeline from independently developed tools.

Each component has a clear responsibility:

• Cloudflare Clef AI provides the inference capability.
• LangChain provides a reusable orchestration abstraction.
• Hono handles HTTP requests.
• Zod validates inputs and data structures.
• TypeScript and Bun support modular development.

This composability matters because an AI-powered system should not have to be tied to one monolithic framework.

A note on openness: Nova uses Cloudflare Clef AI through its inference interface. I am not claiming that the underlying model weights are open-weight or that this integration is equivalent to running a model locally. The open-innovation value here is the ability to combine interoperable tools and open-source application frameworks into a useful system.

That architecture also creates a foundation for experimenting with alternative inference providers or self-hosted models in the future, subject to compatibility and implementation work.

My Agent Session

[Add your DevRelay agent session link or embed your session here, if available.]

This section is optional. Include it if you used DevRelay and saved a session that demonstrates how you built or iterated on Nova.

The Lazy Payoff

The goal of Nova is to reduce the repetitive work between receiving an alert and understanding what to do next.

Without automated triage, an engineer may need to inspect an alert, interpret its context, determine its likely severity, identify the responsible team, and decide whether immediate attention is necessary.

Nova consolidates those initial classification steps into a single API request.

The potential payoff is:

• Less repetitive manual classification.
• More consistent incident metadata.
• A quicker starting point for prioritization.
• Structured results that downstream tools can consume.

I have not established a measured time-saving figure yet, so I would rather not invent one. A useful next step is to benchmark manual triage against Nova-assisted triage across a representative set of incidents.

Nova's output is a recommendation, not a substitute for monitoring signals, on-call routing, or human judgment during critical incidents.

Prize Categories

[Add the applicable partner categories from the official challenge rules.]

What's Next?

Some areas I would like to explore next include:

• Testing classification quality against a labeled incident dataset.
• Measuring latency and classification accuracy across incident types.
• Adding integration points for incident-management tools.
• Supporting alternative inference backends.
• Improving observability around inference failures and classification outcomes.

The long-term goal is to make incident triage more consistent, extensible, and easier to integrate into existing operational workflows.

Final Thoughts

Nova started with a practical question: Can we turn an unstructured operational alert into a useful, structured starting point for incident response?

By combining Cloudflare Clef AI with LangChain and a modular TypeScript API, Nova demonstrates one way to approach that problem without tightly coupling the entire application to its AI provider.

There is still work to do around evaluation, reliability, and real-world integrations, but the project provides a foundation to build on.

Thanks for reading!

If you're working on AI infrastructure, incident management, or developer tooling, I'd love to hear what you'd improve or build next.