Zentra Agent Incident Scribe

Generate clean incident reports from agent and Actor failure evidence.

Make agents earn more

1. One-sentence promise

Write incident reports from evidence, not guesswork.

2. When to use this Actor

Use this Actor when Agent operators, support teams, platform owners needs Convert failure evidence into timeline, impact, cause, and remediation. and a buyer-visible AgentOps artifact before any pay-per-event charge is recorded.

3. When not to use this Actor

Do not use this Actor as a legal, security, compliance, revenue, or incident certification system. Findings are deterministic signals, not a legal, security, or compliance certification. Review high-impact decisions before blocking production workflows.

4. Inputs table

Input	Purpose
inlineItems	Inline records, traces, runs, events, manifests, or scenario artifacts supplied directly by the buyer.
sourceDatasets	Optional user-selected Apify datasets.
sourceKeyValueStores	Optional user-selected Apify key-value stores.
actorJson, inputSchemaJson, outputSchemaJson, readmeText	Actor/package metadata used by policy, passport, audit, and repair flows.
connectorManifests	Optional MCP connector/tool definitions for policy linting.
logText, runMetadata, inputJson, outputJson	Explicit run artifacts used for audit, repair, cost, or incident reports.
scenarios, inlineTraces, inlineRuns, inlineEvents, toolCall	Actor-specific artifacts for monitor, trace, cost, incident, and firewall outputs.
notificationConnectors, destinationConnectors	Optional user-supplied MCP writeback connectors. Destructive actions are not automatic.
dryRun, maxArtifacts	PPE control fields for would-charge ledgers and low-cost buyer trials.

5. Output datasets table

The generated Actor config exposes these dataset aliases:

[
    "default",
    "timeline",
    "findings",
    "evidence",
    "remediations",
    "actions"
]

Every successful run also writes a default dataset row containing the summary, confidence, evidence hash, preflight quote, would-charge ledger, and earnings report.

6. Example input JSON

{
    "incidentTitle": "Agent workflow failed during connector writeback",
    "logText": "403 forbidden while posting update",
    "inlineEvents": [
        {
            "timestamp": "2026-06-18T00:00:00Z",
            "message": "writeback denied"
        }
    ],
    "redactSecrets": true
}

7. Example output rows

{
  "actorSlug": "zentra-agent-incident-scribe",
  "status": "artifact_ready",
  "summary": "Buyer-visible AgentOps artifact produced.",
  "artifact": {
    "kind": "agentops_result",
    "evidence": {
      "redactionApplied": true
    }
  },
  "runSummary": {
    "pricingModel": "PAY_PER_EVENT",
    "wouldChargeEventCount": 1
  }
}

Actor-specific datasets include findings, evidence, clean/quarantine rows, policy packs, audit metrics, scenario results, normalized spans, policy decisions, repair steps, cost events, or incident timelines depending on the selected AgentOps Actor.

8. Privacy and permission notes

This Actor is designed for limited permissions. It can read only its own run storages and user-provided resources selected in the input form. Optional MCP connectors are supplied by the user at runtime through Apify's connector proxy; the Actor does not receive raw third-party credentials.

Secret-looking values are redacted before snippets are stored in evidence rows. Evidence datasets store hashes, redacted snippets, counts, and field paths instead of raw credentials or full logs.

9. PPE pricing notes

Pricing model: PAY_PER_EVENT.

• incident-report-created: $0.5000 after one incident report
• timeline-extracted: $0.1200 after one ordered incident timeline
• remediation-plan: $0.2500 after one prevention plan

The Actor writes preflightQuote.json before paid work and agentEarningsReport.json after the run. Dry runs produce a would-charge ledger without billing. Internal validation runs, canary runs, synthetic checks, and forecasts are not buyer revenue. Buyer-visible charged events are the revenue truth.

10. Troubleshooting

• If the Actor reports ppe-disabled, set ZENTRA_ENABLE_PPE=1 only in the real paid Apify environment.
• If connector findings are high or critical, reduce connector scope before exposing the tool to autonomous agents.
• If no source artifacts are supplied, the Actor runs a deterministic sample so the output contract remains inspectable.
• If a writeback connector fails, review the actions dataset. The core artifact remains valid.

11. Changelog

• 1.0.0: Initial reconciled Zentra AgentOps public Actor package with limited permissions, multiple dataset outputs, evidence hashing, dry-run PPE ledger, and owner-gated publication flow.