Incident Triage

When a production incident is reported, investigate and build a timeline:

1. Gather data — Check available integrations via search_integrations, then:
   • Sentry (if installed): SENTRY_LIST_ISSUES for recent error spikes
   • GitHub: exec({ command: "gh run list --limit 20" }) for recent deploys / CI (do not connect GitHub)
   • Datadog (if installed): DATADOG_QUERY_METRICS for infra metrics
   • If tools aren’t installed, suggest connecting them: search_integrations("sentry"), search_integrations("datadog")
   • Fall back to web to check public status pages
2. Correlate — Build a timeline:
   • When did errors start spiking?
   • Was there a deploy around that time?
   • What changed in the deploy?
   • What’s the impact (error rate, latency, affected users)?
3. Build canvas — Incident timeline:
   • Alert card: severity, impact summary, start time
   • Timeline: sequence of events (deploys, error spikes, metric changes)
   • Root cause card: likely cause with evidence
   • Action items: what to do next (rollback, fix, monitor)
4. Notify — Post findings to incident channel via send_message:

   🔴 **Incident Report**
   **Impact:** [description]
   **Root Cause:** [likely cause]
   **Timeline:** [key events]
   **Next Steps:** [actions]
   

5. Persist — Log incident details to memory for postmortem