Day 87: Workflow Mining From Logs

Trace logs hide how humans actually recover services. Workflow mining agents can cluster spans into candidate runbooks — then stop. Automation without an editor becomes chaos.

⚡ TL;DR: Mine frequent successful remediation sequences from traces. Draft runbooks with citations to trace ids. Require human edit + ownership. Never auto-wire mined steps to mutate tools on day one.

Mining sketch

# ✅ Extract tool/action sequences from successful incidents
def mine_sequences(traces: list[dict], min_support=5) -> list[tuple]:
    seqs = []
    for tr in traces:
        if tr["outcome"] != "resolved":
            continue
        seqs.append(tuple(step["action"] for step in tr["steps"]))
    return frequent_subsequences(seqs, min_support)

Present drafts as markdown with links to example traces. Owners edit; CI stores the runbook SHA the on-call copilot may retrieve (Day 40).

Failure modes

Mining outage thrash (wrong restarts that eventually “worked”) as if it were a good runbook. Filter by outcome=resolved and low customer impact. Rare but critical SEV paths need human-authored runbooks, not miners.

Closing checklist

• [ ] Only mine successful, consented traces
• [ ] Human ownership required before publish
• [ ] No auto-bind to prod mutate tools
• [ ] Version runbooks in git
• [ ] Re-mine quarterly; delete dead paths

Series navigation

Day 86: Search and Ranking Copilots · Day 88: Simulation and Digital Twins for Tools

Last updated September 11, 2026