Card reference
Every investigation is one card. The console, astroctl nova, the API and Slack show the same card with the same words and the same answers, so you can start in one place and answer in another. This page is the reference for that card.
New to investigations? Start with Investigations. For what to do while Nova works, see During an investigation; for approving changes, Fixes and mitigations.
Investigations are listed under Investigations in the console sidebar, in the tabs Open, Resolved, Closed and All. On Open, what needs you is listed first. The list shows incidents, each with its investigations, alerts, timeline and decisions; search them by number or words, and filter by source: Any source, Alert, Chat or Slack. Each investigation lists single investigations instead, searched by title or root cause.
The investigation card
The card reads top to bottom:
- Status and how long it has been running. Once triage has sized it, the status line also shows the size and price, such as
Standard investigation: 5 units (1 if Nova can't read anything). Once it has ended, it shows what it was charged. - Headline: what Nova is doing, or the cause once it has one.
- One supporting line: the quote the answer rests on, or, until there is one, What we know, the main things Nova has observed so far.
- Plan: the steps Nova is taking, each done, active or waiting. A step that waits on a slow read says what it is waiting for. Its last step names the answer: Cause found, Likely cause, No cause found or No problem found.
- Needs you: each question waiting for a person, with its deadline: a read to allow, a change to approve, or Nova's own question. At most one of each kind is open at a time, and each is answered on its own.
- Fix: while you decide it, and how it ended once it has.
- The next step and the actions that apply now, such as Acknowledge, Steer and Stop.
Open the full record opens the rest in a side panel: every read, the evidence quoted with its source and time, what Nova could not check, the causes ruled out, past incidents and the postmortem.
In the terminal, /investigations in astroctl nova opens the same card, in the same words, and it updates as the investigation moves.
Status
| Status | What it means |
|---|---|
| Investigating | Nova is working. |
| Needs you | Nova is waiting on a question only a person can answer: access to a read, a mitigation, or what you see when every read shows the app healthy. |
| Cause found | Nova confirmed the cause on evidence. A fix, when it has one, waits for your approval. |
| Likely cause | The evidence points to a cause Nova could not confirm. The card says what would confirm it. |
| No cause found | Nova could not name a cause. The card shows what it checked and what it could not. |
| No problem found | You reported a problem, but every read showed the app healthy, and you answered It's fine now or did not answer by the deadline. The card shows what Nova read and what it cannot see from where it reads. Nothing to fix. |
| Fixing | Nova is applying the fix you approved, then checking the app. |
| Resolved | The fix was applied and the app was healthy afterwards. |
| Fix failed | The fix did not complete, or the app was still unhealthy after it. |
| You're fixing it | You took the fix over. Your teammates see A teammate is fixing it. Nova changes nothing in this investigation. |
| Approval expired | Nobody answered the fix in time. Nothing changed. |
| Stopped | Someone stopped the investigation. Nova made no change. |
| Did not complete | The investigation could not finish. Nova made no change. |
| Closed | A person closed it without a fix, with a reason. Reopen takes it back. |
When the status is Stopped because the run broke rather than because someone stopped it, the card reads Did not complete.
How a fix ended
The fix on the card, and an alert's Slack thread, say how it ended:
| Fix | What it means |
|---|---|
| Waiting for your approval | The fix is on offer until its deadline. |
| Fix applied | The change ran. Nova checks the app after your health-check window. |
| Fix sent, not confirmed | The change was sent, but the tool did not confirm it applied. Nova still checks the app. |
| Fix failed | The change did not complete, or the app was unhealthy after it. |
| Fix held, no change | Nothing changed, for example only a preview ran. |
| Fix rejected | Someone rejected it. |
| Approval expired | Nobody decided in time. |
| Cancelled | The investigation was stopped. |
| Taken over, no change | A person took the fix over. |
Every answer
The card offers only the answers that apply now. In the console, the primary answer is the filled button.
| Answer | Use it for |
|---|---|
| Allow once, Allow for this chat, Decline | A read Nova asked permission for. Allow for this chat is not offered for a connection that requires single-use approval. |
| Let Nova fix it | The fix on offer. When several fixes are offered, each is its own answer, named Let Nova followed by what it does. |
| Approve, Reject | The mitigation on offer. A fix is not rejected from the card: send reject_fix over the API, or choose I'll fix it myself. |
| I'll fix it myself | Take the fix over; Nova will not change the app |
| Stop | Stop the investigation; Nova makes no further change |
| Acknowledge | Say you have seen it |
| Steer | Tell Nova what to check first, in your own words |
| A suggested answer, or Answer in your own words | Nova's question to on-call |
| Errors for users, Slow, Wrong version, It's fine now, or Answer in your own words | What you see, when you reported a problem and every read shows the app healthy |
| Yes, it's fine, No, Don't know | Nova's request to confirm something it could not check about a found cause |
| Yes, that fixed it, Something else fixed it, That was not it | What fixed it, after you took a fix over and the app is serving again; add your words to correct it |
| Investigate again | Run again after a stop, when the cause is not confirmed or no problem was found, or after a takeover while a read is missing |
| Check health | Read the app's health again after a fix, or once a person owns it |
| Mark resolved | End it yourself, optionally saying what fixed it |
| Close | End it without a fix, with a reason: Not an incident / false alarm, Won't fix, Duplicate of another incident or Handled outside Nova. You can add a note. |
| Reopen | Take a resolved or closed investigation back up |
| Go to the new investigation | A link on the card to the investigation that started again in the same chat |
If someone answered first, or the offer changed or expired, Nova says so and nothing runs.
In the terminal
astroctl nova follows and answers the same card. Type /investigations in the chat. See Nova Terminal for the whole tool.
| Where | Keys |
|---|---|
| The list | ↑ ↓ select, and Enter opens the card. Tab and Shift+Tab, or a number, pick a status tab; s and S the next or previous source. Press /, type, and press Enter to search on the server. r refreshes, n loads the next page, and Esc closes the list. |
| The card | ↑ ↓ scroll. a opens its answers, p prints the card into the conversation, and Esc goes back to the list. |
| The answers | Opened with a on the card, or Ctrl+A on an empty prompt for the investigation you follow in the chat. ↑ ↓ select, Enter reviews the answer and Enter again sends it, so one stray key never answers. Esc closes them. |
| An answer that needs your words | The prompt takes them. Type them and press Enter to send, or Esc to cancel without sending. |
Over the API
The same card, its actions and its live updates are in Nova's API, with the same rules: one answer wins, and an answer that can no longer apply changes nothing. See the API reference.
In Slack
Slack is on the Enterprise plan.
- Start in a thread. Mention Nova and describe the problem. Once Nova has read the first facts, the thread gets the investigation's card, edited in place as it works. An alert-started investigation posts the same card in your alert channel.
- Answer in the thread. The thread has buttons for what it waits on: allow or decline a read (people who may approve reads only), Approve or Reject a mitigation, Let Nova fix it or I'll fix it myself, Nova's question, Acknowledge with the first reply, and afterwards what fixed it. Reply in the thread to answer Nova's question in your own words or tell it what to check first.
- Approvals from Slack. A change can be approved in the thread only when its risk is low and your organization allows Slack approvals; otherwise the button reads Review in the console.
- Console only. Stop, Investigate again, Check health, Mark resolved, Close and Reopen.
- The thread follows through. It hears how a fix ended: applied, did not complete, held, rejected, expired, cancelled, or taken over by a person.
Guardrails, by kind of action
| Kind of action | During an investigation |
|---|---|
| Reads your guardrails allow, such as cluster health, events and metrics | Nova makes them without asking. |
| Reads that require approval, by default Sensitive Data Access | Nova asks first. See Allow or decline a read. |
| Anything in a Blocked category | Never runs. The card lists it under Could not check as blocked by your organization's policy. |
| Fixes and mitigations | Always wait for a person's approval on the card, then run through your guardrails. |
| Calls to your own MCP server that no admin has trusted | Nova asks first, for every call. |
| Slack messages | Follow your Messaging & Notifications rule. |
Every answer is recorded with who gave it and when.
Next
- Investigations: the overview and your first investigation.
- Configure: approvers, limits and cost.
- Guardrails and Approvals: what Nova may do on its own.
- Alerts: let Alertmanager or Grafana start investigations.