Investigations
When an app breaks, Nova investigates it the way an on-call engineer does: it checks what changed, tests the possible causes against evidence, and tells you the cause with the evidence quoted. It reads what your guardrails allow, asks before reading anything sensitive, and changes nothing until you approve the exact change.
To follow one incident from the first question to the postmortem, one task per page, see Operate with Nova.
What an investigation is
An investigation is one card that moves through the same steps every time. Each step is visible on the card, and each decision is recorded with who made it and when.
- You ask, or an alert fires. Name the app and the symptom in a conversation, or let Alertmanager or Grafana start it.
- Nova gathers evidence. It reads what your guardrails allow without asking, and asks first before a sensitive read such as app logs.
- Nova names the cause, or says it could not. The answer is Cause found, Likely cause or No cause found, with the evidence quoted. Nova never gives a percentage.
- Nova proposes a change for a found cause. The card shows the exact change, its risk and how to undo it.
- A person approves it. Nothing changes before that.
- Nova checks the app. After the change, it reads the app's health again and says whether it recovered.
- Nova drafts the postmortem. Blameless, built from the record, and completed once a fix is verified.
| You get | What it is |
|---|---|
| First facts | Whether the app is serving, since when, what changed last and who is affected, each with its source. |
| One of three answers | Cause found, Likely cause or No cause found. |
| Evidence | Each piece quoted from what Nova read, with its source and time. |
| Could not check | What Nova did not read, and why: declined, blocked by policy, or unavailable. |
| A fix you approve | For a found cause: the exact change, its risk and how to undo it, then a health check. |
| A way to restore service first | When a recent deploy lines up with the incident: a rollback, approved separately. |
| A postmortem | Blameless, drafted from the record, completed once a fix is verified. |
Where it runs
The console, astroctl nova, the API and Slack show the same card with the same words, so you can start in one place and answer in another.
| Where | What you can do |
|---|---|
| Nova on the web | Start, follow and answer every investigation. |
The terminal (astroctl nova) | Start one in a conversation, then follow and answer it with /investigations. See Nova Terminal. |
| Slack | Start one from a thread, follow the card in the thread, and answer with its buttons. |
| The API | Find, follow and answer investigations as JSON. See Over the API. |
Plans and cost
Nova is available by request: your organization needs Nova access. Every plan has the full Nova, limited by its monthly Nova units. Enterprise adds more units, Slack, Datadog, Operational Memory and your own MCP servers.
| Free | Enterprise | |
|---|---|---|
| Investigate from a console conversation | Yes | Yes |
| Standard and deep investigations | Yes | Yes |
| Nova applies an approved fix and checks it worked | Yes | Yes |
| Restore service first (rollback offered) | Yes | Yes |
| Alerts start investigations (deep, 10 units) | Yes | Yes |
| Following and answering investigations from the CLI | Yes | Yes |
| Learning from past incidents | Yes | Yes |
| Choosing who approves a change | Yes | Yes |
| Nova units | 175 a month, 20 a day | A pool for the organization, sized to your team |
| Slack | No | Yes |
| Datadog, Operational Memory and your own MCP servers | No | Yes |
A standard investigation costs 5 Nova units and a deep one 10, or 1 unit if Nova can't read anything. See Nova Units.
Your first investigation
Before you start: Nova access for your organization, and at least one app deployed through AstroPulse.
- Check that AstroPulse is connected. In Nova, open Skills: AstroPulse is under Yours. It connects for you, with your own key, the first time you sign in to the organization. If it shows as not connected, for example after its key was deleted, open it and choose Connect Platform.
- Ask about an app. Name the app and the symptom, for example "payments-api keeps restarting. What is wrong?". Nova opens an investigation card and says its size and price before any work starts.
- Answer what Nova asks. Before it reads app logs, Nova asks, for example "Allow Nova to read App Logs for checkout?". Allow once covers one read. Allow for this chat, when it is offered, covers the same app, tool, connection and schema until the access grant expires. Decline lets Nova carry on without them.
- Read the answer. The card ends with Cause found, Likely cause or No cause found, with the evidence quoted.
- Approve the fix, or take it over. Let Nova fix it applies exactly the change shown, then checks the app. I'll fix it myself hands it to you.
| Vague | Better |
|---|---|
| "Something is broken." | "checkout returns 5xx errors since about 14:00." |
| "Fix the app." | "payments-api keeps restarting. What is wrong?" |
In this section
- Start an investigation: from a conversation, an app page, the terminal, Slack, or automatically when an alert fires.
- During an investigation: allow reads, answer Nova's question, steer, acknowledge, ask follow-ups or stop.
- Fixes and mitigations: how changes are proposed, approved and checked.
- How Nova investigates: the reasoning, the rules for evidence, and what it found in practice.
- Configure: skills, guardrails, approvers, limits and cost.
- Card reference: every status, every answer, the terminal keys and the API.
Use cases
- Set up Nova for your team: connect your stack, wire in alerts, and set guardrails and approvers.
- Investigate a failing app: ask, allow a read, read the cause.
- Start an investigation when an alert fires: let your alerting start it.
- Restore service first, then approve the fix: roll back, then fix, then check health.
- Work an incident from Slack or the terminal: answer where you already are.
- Write the postmortem from the record: what Nova drafts, and what you add.
Next
- Build an AI SRE on call: set it up and work one incident, step by step.