How Averil works
How a signal becomes a case, how the case moves through its states, and what Averil means when it says a fix is verified.
From signal to closed case
- 1A signal arrives: a webhook (a GitHub push, a repository made public), a scheduled check of one of your tools, or an event from the laptop Companion. Averil stores the raw data with its SHA-256 hash before anything else.
- 2It converts the event to a standard format (OCSF) and records where it came from.
- 3Detection rules run on the stream of events. A model does not read every event.
- 4Related events are grouped, so one problem becomes one case.
- 5Code gathers the context: the owner, recent changes, past cases, facts your team confirmed, and known blind spots.
- 6Triage decides to dismiss with evidence, investigate, or escalate.
- 7A lead investigator and specialist agents investigate with read-only tools and a fixed budget.
- 8Code checks that every claim cites real evidence. Then a model from a different provider argues against the conclusion.
- 9Averil writes one Slack thread for the case from the verified result.
- 10A person decides: approve the plan, assign the case, or accept the risk until a date.
- 11The executor runs the approved plan, one step at a time.
- 12Averil reads back the live state. Only then does the case close.
Case states
| State | What it means |
|---|---|
| Open | The case exists and evidence is stored. |
| Triaging | Averil is deciding what this is and how much it matters. |
| Investigating | Agents are gathering and testing evidence. |
| Awaiting human | A person needs to read the case, answer a question or decide. |
| Action planned | A plan is approved and waiting to run. |
| Verifying | The plan ran and Averil is reading back the result. |
| Resolved | The read-back matched the plan, or the owner confirmed the fix. |
| Dismissed with reason | Closed as not a problem, with the reason on record. |
| Risk accepted until | A person accepted the risk until a set date. |
| Escalated | Handed to people, with the reason on record. |
Any closed case can reopen. A reopen needs a reason and starts a new version of the case, so the history of the old one stays intact.
What "verified" means
A case is verified only when code reads the live state of your system and it matches the outcome the plan expected. For example, after turning branch protection back on, Averil reads the rule back from GitHub and cites that read as evidence. A model cannot mark a case verified.
Sometimes a fix happens outside Averil and the owner confirms it. That counts as owner-confirmed, and Averil reports it separately from verified.
Averil tracks four numbers you can check: time to verified resolution, verified-resolution rate, owner-confirmed share, and reopen rate over 30 days.
Evidence comes first
Raw evidence and Averil's interpretation are stored separately. A model's conclusion never overwrites what a system actually returned, and every claim in a case thread links to the evidence behind it. Claims without evidence are dropped from the thread.
Stuck? Email averil@averil.ai or ask me in Slack.