investigation-dag-planner

Investigation DAG Planner

Overview

Real investigation rarely follows a linear path. When multiple hypotheses exist, some can be tested in parallel while others have dependencies. Testing whether the database is overloaded and whether the payment service has memory pressure use different data sources — they can run simultaneously. But testing for a network partition between two services only makes sense after ruling out simpler explanations.

This is the dynamic-DAG-construction pattern (Example 5-15) applied to incident diagnosis. The planner:

1. Analyzes dependencies between hypotheses/tasks.
2. Identifies groups that can safely run in parallel (a topological level — the same computation bd ready performs in Beads, and parallel_groups in Example 5-15).
3. Organizes them into phases. Within each phase, tasks are ordered by priority (the historically/structurally most-likely hypothesis first).
4. Estimates each parallel phase's duration as the max of its concurrent tests, since they run concurrently — not the sum.

Execution then proceeds phase by phase with early termination: as soon as a hypothesis is confirmed with sufficient corroborating evidence, remaining phases are skipped. A dependency cycle raises CycleError — that is a malformed plan, surfaced rather than silently mis-executed.

In the DevOps latency investigation (account 123456789012), the checkout latency spike yields three hypotheses. The DAG groups db_pool_exhaustion and payment_memory_pressure into one parallel phase (different data sources); network_partition depends on ruling out the pool hypothesis, so it lands in a later phase. When the pool hypothesis confirms in the first phase, early termination skips the network-partition test entirely.

When to Use

• A planning node must decide which tasks are parallel-safe and order phases
• Incident-investigation hypothesis testing, multi-track research, multi-party claim processing (the chapter's multi-vehicle-accident example)
• You want an explicit duration estimate and an auditable phase structure