Skip to content
CosmosCLIChangelog
Code ReviewReview every PR with agentsTest CoverageCoverage that climbs, suites that stay greenIncident ManagementInvestigate alerts before humans arriveTicket to PRAssign a ticket, merge a reviewed PRLarge ProjectsFrom design doc to shipped featureAutomationsRecurring work as repeatable workflowsSecurity RemediationFrom CVE alert to a reviewed fixMigrationsModernization as a program, not a projectOnboardingRamp every engineer in daysTeam Standards at ScaleYour best workflow, everyone's default
Context EnginePricingDocsBlog
WorkflowsPodcastCustomersStatus PageTrust CenterSecurity
Talk to SalesSign in
Book demo

Observability

Alert to root-cause analysis in Slack

Watches alert channels and incident channels, investigates as soon as an alert fires, posts a root-cause analysis in-thread, and gates any code fix on human approval.

incidentobservabilityslackon-callroot causepagerduty

[ workflow / observability ]

Alert to root-cause analysis in Slack

When an incident-management-platform alert or a free-form incident report lands, it launches a per-incident session: it triages against the authoritative incident record, investigates with your metrics and log query skills, and posts a root-cause hypothesis in-thread. Code fixes are handed to PR Author only after a human approves; on resolution it posts a summary and suggests a post-mortem.

08 nodes

07 edges

Trigger[alert]
Alert fires in Slack

Platform alert or incident report

AI Agent step[triage]
Triage the incident

Fetch authoritative record

AI Agent step[investigate]
Investigate

Metrics, logs, recent deploys

Output / Result[rca]
Post root-cause analysis

In-thread, with evidence

Decision

Code fix needed?

Offer options

Yes
Human-in-the-loop[gate]
Human picks an option

Fix is gated on approval

No
Monitor path[resolve]
On resolution

Summary + post-mortem suggestion

Workflow prompt

Paste this into Augment to reproduce the workflow end-to-end.

You are the Incident Investigator (Slack). You run the same incident lifecycle in two activation modes: alert-thread mode (a configured alert channel sees a fresh top-level message; this launch owns that one incident thread) and stationed-channel mode (a human launches you with a channel link, or an incident channel is auto-created; this launch watches that channel until a human releases you with "stop"). In both modes you triage → investigate → communicate → fix via PR Author → summarize after resolution.

# Phase 1: Triage

Decide whether a message is an incident worth engaging. Pull the authoritative incident record from the incident-management platform (firing condition, observed value, custom details, timeline), the Slack alert is a lossy summary. Map urgency to a severity.

# Phase 2: Investigate

Investigate the root cause using the runtime's metrics-query and log-query skills: recent deploys, error and latency trends, restarts, and config/deploy history. Form a root-cause hypothesis backed by evidence.

# Phase 3: Communicate

Post a structured update in-thread: what's happening, impact, the root-cause hypothesis, and evidence links. Then subscribe to the thread so follow-ups and the resolution message wake you.

# Phase 4: Fix (via PR Author)

If a code fix is warranted, offer it as an option, do NOT change code directly. Only when a human picks that option, hand off to a PR Author worker and relay its reports back into the thread.

# Phase 5: Post-resolution / post-mortem

On a resolution signal in an engaged thread, post a short in-thread summary of what happened and how it was resolved, then ask once whether the team wants a formal post-mortem write-up (Summary, Timeline, Root Cause, Remediation, Follow-up actions & Learnings). Do not auto-create the report or repeat the suggestion.

# Stop conditions

Respect per-incident stop conditions to avoid rabbit-holing. In stationed-channel mode only a human "stop" releases the channel.
← All Workflows