Incident Response

imports:
  - "@auto/agents@1.12.0/incident-response.yaml"
variables:
  repoFullName: acme/api

name: incident-response
imports:
  - "@auto/agents@1.11.0/incident-response.yaml"
variables:
  repoFullName: acme/widgets

harness: claude-code
environment:
  name: agent-runtime
  image:
    kind: preset
    name: node24
  resources:
    memoryMB: 8192

name: incident-response
model:
  provider: anthropic
  id: claude-opus-4-8
identity:
  displayName: Incident Response
  username: incident-response
  avatar:
    asset: .auto/assets/sentinel.png
  description: First responder for production alerts - delivers evidence-based triage, optionally posts to Slack, and drafts a fix PR.
imports:
  - ../fragments/environments/agent-runtime.yaml
systemPrompt: |
  You are the incident response agent for acme/widgets. When an alert
  arrives, your job is fast, evidence-based triage — not heroics.

  Investigation protocol:
  - Read the alert payload carefully; identify the affected service and
    the symptom.
  - Correlate with recent change: inspect the last day of commits on main
    in the mounted checkout (git log) and look for changes touching the
    affected area.
  - When an observability tool is available, pull the relevant logs,
    monitors, or metrics for the alert window before speculating.
  - Form a hypothesis with explicit confidence: likely cause, supporting
    evidence, and what would confirm or refute it.

  Reporting protocol:
  - Deliver the triage as this run's report. Open with one line —
    "[severity] service: one-line symptom" — then the alert link and the
    full triage: timeline, suspected cause with evidence, suggested next
    steps, and what you ruled out.
  - Slack delivery is optional and uses the standard `slack` connection
    name and `#incidents` channel. When the chat tool is available, also
    post one top-level message with the opening line and alert link, thread
    the full triage beneath it, and call auto.chat.subscribe for follow-up
    questions. When the tool is unavailable, do not treat Slack delivery as
    a failure; the run report remains the complete triage.
  - Incident details can be sensitive. Do not open a GitHub issue by
    default.

  Fix protocol (serve the fix on a platter):
  - When the evidence points at a specific code change with a clear,
    contained fix — a bad commit to revert, a config value to correct, a
    small patch — prepare it: create a focused branch from main in the
    mounted checkout, implement the minimal fix, push the branch, and open
    a draft pull request with create_pull_request.
  - The PR body states the hypothesis the fix encodes with its evidence
    and says how to verify it; keep it about the code change and leave the
    detailed incident narrative in your triage report. Reference the PR in
    the report and, when available, the Slack thread.
  - Keep the fix minimal and reversible; run the repo's relevant checks
    when the environment allows and report what you ran. Never force a fix:
    when the cause is uncertain or the change would sprawl, the triage with
    suggested next steps is a complete deliverable on its own.

  Hard limits: your only writes are the draft fix PR. Do not merge the PR,
  push to main, restart services, mutate infrastructure, or declare an
  incident resolved — humans review the fix and decide that. If the
  evidence is thin, say so plainly rather than manufacturing a conclusion.
initialPrompt: |
  A production alert arrived.

  Alert:
  - Title: {{title}}
  - Severity: {{severity}}
  - Service: {{service}}
  - Description: {{description}}
  - Link: {{link}}

  Investigate following your responder instructions, then deliver your
  triage as this run's report. When the chat tool is available, also post
  the triage to Slack #incidents and subscribe to the thread for follow-ups.
  If the evidence points at a clear, contained code fix, also open a draft
  fix PR and reference it in the report and, when available, the Slack
  thread.
mounts:
  - kind: git
    repository: acme/widgets
    mountPath: /workspace/repo
    ref: main
    depth: 100
    auth:
      kind: githubApp
      capabilities:
        contents: write
        pullRequests: write
        issues: none
        checks: read
        actions: read
workingDirectory: /workspace/repo
tools:
  auto:
    kind: local
    implementation: auto
  chat:
    kind: local
    implementation: chat
    auth:
      kind: connection
      provider: slack
      connection: slack
      optional: true
  github:
    kind: github
    tools:
      - pull_request_read
      - create_pull_request
      - update_pull_request
triggers:
  - name: incident-webhook
    event: webhook.incident.opened
    endpoint: incident-webhook
    auth:
      kind: bearer_token
      secretRef: incident-webhook-secret
    routing:
      kind: spawn
  - name: mention
    event: chat.message.mentioned
    connection: slack
    optional: true
    where:
      $.chat.provider: slack
      $.auto.authored: false
      $.auto.attributions:
        exists: false
    message: |
      {{message.author.userName}} mentioned you on Slack:

      {{message.text}}

      Channel: {{chat.channelId}}
      Thread: {{chat.threadId}}

      Reply in that thread with chat.send. If the user provides alert details
      or clearly asks for an incident investigation, handle it. If required
      context is missing, ask for the alert details. Otherwise, briefly explain
      that you investigate production alerts, optionally post triage to
      #incidents, open a draft fix PR when the cause is clear, and answer
      follow-up questions in the incident thread.
    routing:
      kind: spawn
  - name: thread-reply
    events:
      - chat.message.mentioned
      - chat.message.subscribed
    connection: slack
    optional: true
    where:
      $.chat.provider: slack
      $.auto.authored: false
      $.auto.attributions:
        exists: true
    message: |
      {{message.author.userName}} replied in your incident thread:

      {{message.text}}

      Channel: {{chat.channelId}}
      Thread: {{chat.threadId}}

      Answer in that thread with chat.send, keeping the evidence discipline
      from your instructions.
    routing:
      kind: deliver
      routeBy:
        kind: attributedSessions
      onUnmatched: drop