How AI Digital Employee “Nüwa” Cuts P1 Incident MTTR from Hours to Minutes

Problem

Even with modern CI/CD pipelines and observability, a P0/P1 alert at 3 am still forces engineers to jump between dozens of systems, parse massive logs, and trace dependencies. A team investigation of a typical P1 incident showed engineers spent 4–6 system hops, and more than 60% of the handling time was consumed by “locate + understand” tasks, despite most faults (null‑pointer, out‑of‑bounds, configuration errors) following known patterns.

Nüwa Architecture

Standardized workflow

Alert & Perception – Custom alerts (DongMonitor) automatically extract application name, TraceID, timestamp, and environment.

Log Retrieval – Using TraceID, a time window and keywords, Nüwa paginates relevant logs, eliminating manual “needle‑in‑a‑haystack” searches.

Root‑Cause Analysis – A large‑model joint‑inference workflow identifies the cause from log context, recent code changes and configuration diffs.

Fault Type Routing – The model classifies the incident as a non‑code issue (e.g., network jitter, downstream throttling) or a code bug, and skips unnecessary code changes.

Repair Plan – Generates one or more fix proposals together with risk, impact, compatibility and rollback assessments; a human decides whether to proceed.

Code Generation – AST‑level static analysis derives the impact scope and produces precise patches, reducing accidental modifications.

Submit MR – Auto‑fills a Merge Request template with problem description, root‑cause summary, test suggestions and impact assessment.

MR Review – Built‑in code‑review skill checks style, potential defects, performance and security before human approval.

Merge & Deploy – Supports automatic merge of the MR and cloud‑orchestrated release.

Core capabilities

Smart perception and precise log retrieval

When a P0/P1 alert arrives, Nüwa instantly extracts service name, environment, instance and TraceID, then invokes the internal .Logbook日志检索（零售区） and .Logbook日志路径查询（零售区） skills to paginate logs within the specified time window, building a complete call‑graph view without manual searching.

Large‑model driven root‑cause reasoning

Instead of keyword matching, Nüwa runs a large‑model workflow that jointly analyzes log context, recent commits and configuration differences. It can automatically classify incidents as non‑code problems (e.g., network jitter) and generate an analysis report, or as code bugs and hand over to the repair stage.

AST‑level code analysis and AI repair

After confirming a code defect, Nüwa creates a repair branch from the mainline in the code‑hosting platform (e.g., Coding). Using AST‑level static analysis it derives the impact scope and produces multiple fix proposals that include compatibility, performance and rollback difficulty assessments. The selected patch is automatically committed, and the MR is submitted with a populated template.

Quantitative efficiency gains

Three months of incident data show the following average times per stage:

Alert perception & log retrieval – Traditional: 20‑40 min (engineer wake‑up → VPN → log search). Nüwa: <5 min (auto‑extract TraceID, retrieve logs). ≈80% human effort saved.

Root‑cause analysis – Traditional: 30‑60 min (read stack traces, check commits). Nüwa: 2‑5 min (model‑driven inference). ≈90% human effort saved.

Code fix & verification – Traditional: 40‑90 min (manual patch, test, review). Nüwa: 5‑10 min (AST‑generated patch, auto‑review). ≈85% human effort saved.

Release & deployment – Traditional: 15‑30 min (pipeline wait, manual trigger). Nüwa: 3‑5 min (auto‑merge, one‑click orchestration). ≈80% human effort saved.

Overall MTTR dropped from 120‑240 min to 15‑25 min (≈50% reduction) and total human effort for a P1 incident fell from 2‑4 h to 15‑25 min, an aggregate efficiency improvement of about 85%.

Interaction model

Nüwa is reachable via mobile IM tools (Feishu, WeChat Work, DingTalk). Engineers receive structured cards on their phones and can converse in natural language (e.g., “Nüwa, fetch the latest logs”), approve Merge Requests with a tap, and continue other work. A real‑time scenario resolved a midnight alert in 11 minutes without opening a computer.

Future roadmap

L1 Assistive Driving – Auto‑analysis, auto‑repair, human approval.

L2 Cooperative Driving – Unattended low‑risk releases with automatic rollback.

L3 Full Autonomous Driving – Targeting coverage of ~70% of common faults to achieve system‑level self‑healing.

Vision

Nüwa is not intended to replace engineers but to eliminate repetitive, time‑consuming tasks—log search, root‑cause deduction, patch generation and workflow orchestration—so that engineers can focus on architecture, complex decisions and business innovation.