Anomaly timeline
p95 latency with rolling baseline bands and a hard deploy marker at 14:32. The break is visually obvious — at least 2× baseline.
Clickfuse is a chat agent that turns “Why did checkout latency spike after the 14:32 deploy?” into an evidence-backed incident board — anomaly timeline, service heatmap, before/after diff, suspect ladder, error-budget impact, and a verdict card.
The problem
Logs, traces, and dashboards exist — but when checkout breaks after a deploy, SREs still stitch the story together by hand. Generic “chat with your data” returns prose. Clickfuse returns a board you can defend in a war room.
“It looks like latency increased around the deploy. You may want to check the payment service and recent config changes…”
Timeline · Heatmap · Diff · Suspects · Error budget · Verdict — each with Show evidence → SQL + window + confidence
Incident proof board
The chat input starts the investigation. The response is the visual, interactive artifact — assembled progressively so the narrative lands before the last panel paints.
p95 latency with rolling baseline bands and a hard deploy marker at 14:32. The break is visually obvious — at least 2× baseline.
Click a service to highlight it across the board. payment-service lights up red; peers stay cool gray/green.
Span-level amplification from a single CTE query. payment spans jump ~8.3× while inventory and shipping stay flat.
Ranked root-cause candidates. payment-service v2.4.1 sits at #1 with the retry-timeout config diff called out.
Demo-visible burn so the business cost of the spike is part of the board, not a follow-up tab.
A clear close: roll back v2.4.1 or restore the 3s retry timeout — grounded in the panels above it.
Each drawer exposes the ClickHouse query, time window, row count, confidence,
and Trigger.dev task context. Timeline includes both the raw
http_logs anomaly-band query and a
quantileMerge proof against
latency_rollup_1m (AggregatingMergeTree State/Merge).
SELECT minute, service, p95_ms,
rolling_avg + 3 * rolling_stddev AS upper_band,
p95_ms > rolling_avg + 3 * rolling_stddev AS is_anomaly
FROM baselines
WHERE rolling_avg IS NOT NULL
ORDER BY minute, service;
How it works
Start from chat with the frozen demo sentence — or render the fixture board offline for judges and demos without credentials.
The agent runs schema tasks: query-latency, query-heatmap, query-diff, rank-suspects, calculate-error-budget — each a first-class unit in the run trace.
MergeTree source tables, AggregatingMergeTree rollups with quantileState / quantileMerge, window-function anomaly bands, and before/after span diffs — all readonly.
Skeleton panels fill as tasks complete. Open evidence drawers, click the payment hotspot, walk the suspect ladder, close on the verdict.
Seeded incident
At 14:32, payment-service v2.4.1 changes retry timeout from 3s → 15s. Checkout p95 spikes ~2.6×. Payment spans amplify ~8.3×. Everything on the board exists to make that story impossible to miss.
“The agent found that the 14:32 payment deploy changed retry behavior, causing checkout latency to spike, and every visual is backed by ClickHouse evidence.”
Stack
Primary data layer. MergeTree logs & spans, deploy events, AggregatingMergeTree 1m rollups, parameterized readonly queries.
Chat agent with versioned prompt telemetry, task-backed tools, typed board parts, optional live streaming, and run-trace proof.
Incident board UI with progressive skeleton assembly, fixture mode for offline judging, and live transport when credentials are set.
pnpm smoke asserts the demo story is visually obvious before you hit record — deploy marker, 2× spike, payment #1, rollup path present.
Public fixture-mode demo needs nothing. Local path is three commands.
pnpm install
pnpm smoke
pnpm dev
# then ask:
# Why did checkout latency spike after the 14:32 deploy?
Open the public fixture demo, or clone the repo and run smoke checks before your own recording.
Build Week prototype · MIT License · Not a general observability platform