At 2am a database gets slow. Within a minute your pager fires eleven times: the database, the two services that query it, the API gateway in front of them, the checkout flow, the synthetic check on the marketing site. Eleven alerts, one problem. Whoever is on call spends the first ten minutes just working out that they are the same problem.
The alerts already knew they were related
The information needed to collapse those eleven pages into one was sitting right there — in the call graph. Checkout depends on the API gateway, which depends on the services, which depend on the database. That is not tribal knowledge; it is observable, and byteshift observes it. Every service in your telemetry becomes an entity, and every call between them becomes an edge whose direction is the dependency.
Walking it backwards
Edge direction is the whole trick. To find the blast radius of a failing component, you walk the edges backwards— from the thing that broke to everything that leans on it. The slow database's blast radius is the services, the gateway, and checkout, in that order of distance. Now the eleven alerts have a shape: one root cause, a ranked list of affected entities, and the path connecting them.
One incident, assembled
So a monitor trip doesn't just open an alert. It anchors to a source entity, pulls in the affected entities along its blast radius, and then asks a question: is there already a live incident on a graph-connected entity? If so, this trip joins it, recording the connecting path as evidence. If not, it opens a new one. Severity starts from the monitor and is escalated by how much criticality-weighted surface area the failure actually threatens — a slow database under checkout outranks the same slowness under a cron job.
What the on-call sees
Instead of eleven pages, one incident: root cause at the top, affected services ranked by distance, the graph path as proof, and a timeline that assembles itself. When every feeding monitor has been green long enough, it resolves on its own. The graph did the correlation that a human used to do half-asleep — which is exactly the kind of work observability should have been doing all along.