| name | triage-logs |
| description | Turn noisy signals into structured analysis |
| user-invocable | false |
triage-logs
Triage production signals into structured, actionable analysis. Methodical,
hypothesis-driven, biased toward reversible mitigations. Start with the
smallest useful packet, not a full data dump.
Procedure
- Gather context, at most three questions, preferring binary and pick-one: a
log excerpt or alert payload, the time window and
environment, and any recent deploys, flag flips, or config changes.
- Separate user-visible symptoms from operator-visible signals.
- Assess impact: user impact, business impact, blast radius.
- Catalog signals by type: logs, metrics, traces.
- Check recent changes in the relevant window: deploys, config, feature
flags.
- Form testable hypotheses ranked by plausibility.
- For each hypothesis, define a quick check with expected and actual
outcomes.
- Propose mitigations, reversible first, each with its risk and rollback.
- Prioritize concrete next actions.
- Write
~/.agentic-sdk/<project>/artifacts/ops/YYYY-MM-DD_triage_<issue_slug>.md with:
Metadata, Summary, Symptoms, Impact Assessment, Observed Signals, Recent
Changes, Hypotheses, Experiments, Findings, Mitigations (reversible first),
Next Actions, Open Questions, Data Request Packet. Slug: lowercase,
hyphens, descriptive.
Boundaries
Owns signal triage and hypothesis ranking. review-incident owns the blameless
incident review; analyze-root-cause owns the causal chain. Reached by
investigate.
Return
One line: the artifact written, the top hypothesis, and current impact, or
blocked: <reason>.