Bounded JSON actions
The model chooses from explicitly supported operations instead of receiving unrestricted shell access. Invalid JSON, unknown actions, malformed payloads, and execution failures score zero.
Research project
CrashDiag: Mechanically Verified RL for Infrastructure Repair
CrashDiag trains language-model agents to diagnose and repair infrastructure faults. The policy emits one bounded JSON action, and reward comes from executable sandbox state rather than an LLM judge.
In preparationCrashDiagIndium AI LabsGRPO
Overview
Abstract
Many agent evaluations reward answers that sound right. CrashDiag tests a stricter question: did the model produce an action that made a broken system healthy again? Each scenario injects a known infrastructure fault, gives the model an incident observation, executes the model's bounded JSON action, and scores the result through deterministic state checks.
The environment currently uses a dependency-free MockSandbox with process, environment, database, dependency, disk, proxy, and HTTP health state. It supports deterministic SFT data generation, answer-free GRPO datasets, executable rewards, local and remote evaluation, signed artifacts, and fail-closed promotion gates.
Why mechanical verification matters
Infrastructure repair has a useful property: many outcomes can be checked directly. A process is running or it is not. A dependency version matches or it does not. A proxy points to the right port or it does not. CrashDiag uses that property so models cannot earn reward by writing confident explanations.
Research questions
- Can a model learn actions that actually repair infrastructure state rather than merely describe plausible fixes?
- How much does GRPO improve remediation success once SFT has taught the model the action interface?
- Which fault families expose brittle diagnosis, invalid JSON, or reward-hacking risk?
- How should the action space expand while keeping verification, safety, and reproducibility intact?
Design
Environment design
CrashDiag keeps the action contract narrow enough to audit while making reward depend on executable system outcomes.
State-based verification
Each rollout rebuilds the exact seeded fault scenario, executes the parsed action, then checks both the fault-specific state and application health.
Answer-free GRPO data
The reinforcement-learning rows provide the scenario, not an expert completion. Candidate actions are scored by executing them in the sandbox.
Fault suite
Initial mechanically checked tasks
The current environment covers six one-action fault families with state-based resolution checks.
| Fault | Difficulty | Verifier | Action |
|---|---|---|---|
| bad_env_var | easy | invalid APP_ENV blocks health | rollback_env_var |
| port_proxy_misconfig | easy | proxy and app ports disagree | fix_port_config |
| oom_kill | medium | process stopped with OOMKilled | restart_app |
| broken_db_connection | medium | DATABASE_URL is invalid | rollback_env_var |
| disk_full | medium | disk usage exceeds health threshold | clear_disk |
| dependency_mismatch | hard | installed and required versions differ | fix_dependency |
Evaluation metrics
Mechanical successStrict JSONBackend error ratePer-fault successSchema-v1 regressionReward varianceGradient signalAdapter provenance
Current research candidate
The GRPO v1 research candidate resolved 175/192 hard schema-v2 episodes, or 91.15%, and resolved 96/96 original schema-v1 regression episodes. This is encouraging, but it remains a research candidate until the exact parent-SFT hard baseline is completed on the identical evaluation set.
Roadmap
CrashDiag research plan
The roadmap is centered on stronger baselines, broader faults, hardened sandboxes, and careful claims.
Now
Mechanically verified hard evaluation
CrashDiag v1 candidate
The private-bucket GRPO v1 research candidate resolved 175/192 schema-v2 hard episodes and 96/96 schema-v1 regression episodes under the MockSandbox verifier.
Next
Exact parent-SFT comparison
Baseline closure
Run the parent-SFT hard baseline against the identical 192-row evaluation set before attributing the candidate performance specifically to GRPO.
Expand
Broader infrastructure faults
Fault suite + sandbox
Add more fault families, tighten action contracts, harden the HTTP sandbox service, and move toward deployment-backed fault injection.
Lab
Shared verifier-first environment stack
Indium AI Labs
Use CrashDiag as the infrastructure-repair foundation for a broader lab direction around mechanically verified infrastructure and security agents.
Paper status
In preparation. The current writeup will focus on the environment contract, mechanical verifier, answer-free RL data, baseline comparisons, and limits of the present MockSandbox implementation. It is not an accepted publication.
Explore
CrashDiag is the first infrastructure-repair environment under Indium AI Labs.