AnyoneLearnAI
Start learning
Chapter DProduction monitoring labPage 5 of 8

Production monitoring lab

Handle failures and retries

Production monitoring lab is production work only when one frozen failure can be reproduced, one measurable gate can stop a release, and one operator can safely reverse it.

~14 minFailure handling

Before you start

Why this matters

Read this incident aloud: retrieval returns fewer chunks after an index refresh while HTTP status and model latency remain normal. In two minutes, write the earliest deterministic check that should fail, the telemetry signal you would inspect, and the action that must not happen automatically. Compare your answer with this chapter's boundary: operators see aggregates and redacted traces; raw user text requires break-glass access.

1Learn the idea

Read

Reproduce failures and debug safely

Reproduce the global dashboard masks a 35% quality drop limited to account-recovery requests without editing the prompt first. Load the frozen fixture, set a known release, replace network calls with the failing response, and capture one trace. Confirm that the failure happens twice. If it does not, the reproduction is not controlled enough to support a fix. Debug in transaction order: input acceptance, normalization, retrieval or routing, model/tool decision, output validation, then side effects.

Classify the fault before retrying. Timeouts, 429s, and temporary 5xx responses may be retryable with capped exponential backoff and jitter. Schema violations, authorization mismatches, unsafe tool requests, and failed quality assertions are not transient; retrying repeats risk and cost. Use a maximum attempt count and a deadline. For side effects, retry only behind an idempotency key or transactional outbox.

A fix is complete only when the reproduction becomes a permanent regression case. Add a negative assertion so the old unsafe or incorrect behavior cannot return silently. Preserve the trace ID and policy version in the test output, but redact payloads according to the same production policy. The operational response is to freeze promotion, page the owner, inspect retrieval traces, then roll back the index alias if confirmed.

For failure handling, start with the named reproduction and add controlled timeout, malformed output, duplicate delivery, and forbidden-action variants where relevant. Demonstrate that retries cannot multiply side effects.

Read

Focused implementation artifact

def execute_with_policy(operation, *, attempts=3):
    for attempt in range(attempts):
        try:
            return operation()
        except (TimeoutError, ConnectionError):
            if attempt == attempts - 1:
                raise
        except (PermissionError, ValueError):
            raise  # deterministic or unsafe: never retry

def test_known_failure_is_contained():
    case = {"release":"2026.07.18-canary","request_id":"req_a19","intent":"account_recovery","retrieved_count":0,"groundedness":0.22,"latency_ms":1180,"status":200,"cost_usd":0.011}
    decision = monitor.evaluate(events, baseline="2026.07.11", window="10m")
    assert decision.severity == "page" and decision.suspected_span == "retrieve"

Read

Diagnose before retrying

Run the named reproduction—the global dashboard masks a 35% quality drop limited to account-recovery requests—with a frozen clock and recording adapters. Capture the ordered calls and one trace. Re-run it to prove determinism, then locate the first stage whose actual output differs from its contract. Change only that stage. Prompt tuning is not a substitute for an authorization, idempotency, schema, or accounting fix.

Inject a timeout before any side effect and another after the dependency reports success. The first may be retried under a deadline; the second requires reconciliation because blind retry could duplicate work. Prove attempt count, backoff cap, and final error classification. Deterministic policy failures must make one attempt. Side effects require an idempotency key or transactional outbox.

Turn the reproduction into a permanent test and assert the old behavior is absent. Recompute grounded answer rate by intent and release under retries so hidden attempts do not improve the denominator. Emit support_answer_grounded_ratio with error_type from a bounded enum. If containment fails, freeze promotion, page the owner, inspect retrieval traces, then roll back the index alias if confirmed.

Checking tutor…

Continue learning · glossary & guides