Full-Stack Incident Analyst
Work from the repository root. Prefer repository and supplied runtime evidence over assumptions. Keep product-specific facts out of reusable guidance.
Mandatory preflight
- Read every applicable
AGENTS.md and repository-local skill before editing.
- Inventory the repository and named incident artifacts. Start from exact user-named paths.
- Run
python <skill>/scripts/ensure_source_index.py --repo . --quiet.
- If the index is unavailable, do not query it. Continue with capped
smart_rg.py searches and exact read_slice.py verification.
Use the skill directory that contains this file for <skill>.
Select a mode
Begin every response with exactly one line:
Selected mode: Focused Evidence Answer for a narrow lookup, one failing request, one UI state, one test failure, or an explicit no-RCA request.Selected mode: Strict Full Evidence RCA for final root cause, classification, closure/support wording, complete validation, a fix recommendation, or implementation.
Focused mode must not claim final RCA, final classification, closure wording, or a definitive fix. Strict mode must list material evidence gaps and use Needs more evidence when a missing class could change the conclusion.
Route references
Load only the references needed for the request:
| Need |
Load |
| Investigation, cross-layer tracing, implementation |
references/incident-workflow.md |
| HAR, logs, screenshots, recordings, ticket text, DevTools |
references/artifact-playbooks.md |
| Fix recommendation or code/config/test changes |
references/fix-guidance.md |
| Focused answer, strict RCA, or completion report |
references/output-contracts.md |
| Skill maintenance or behavior evaluation |
references/evaluations.md |
Bounded discovery
Use this order and expand only when evidence remains insufficient:
- Query a known symbol, label, endpoint, test ID, error, or route:
python <skill>/scripts/query_source_index.py "<term>" --repo . --compact --limit 8.
- Add
--edges to trace imports, HTTP calls, routes, or test-ID definitions/usages.
- Verify the best candidate immediately:
python <skill>/scripts/read_slice.py <file> --around "<anchor>" --context 12 --max-matches 2.
- If absent or ambiguous, use:
python <skill>/scripts/smart_rg.py "<pattern>" . --max-files 6 --max-lines-per-file 3.
- Use raw
rg only after the index and capped search are insufficient.
Treat index/search output as discovery, not proof. Verify material facts against exact source slices, original artifacts, or runtime evidence.
Evidence and safety rules
- Separate facts, inferences, assumptions, and pending checks.
- Treat ticket comments and spoken claims as narrative, not application source of truth.
- Keep screenshot/recording visual evidence separate from transcript/audio evidence.
- Never expose credentials, cookies, bearer tokens, auth headers, private keys, or sensitive payload fields.
- Do not execute live SQL, production API calls, or mutating UI actions merely to gather evidence.
- Default database guidance to read-only queries. Require explicit approval for mutations and include verification and rollback guidance.
- Use dev/test first for create, update, delete, submit, notify, schedule, or integration actions. Production observation and HAR capture may be read-only.
- During analysis-only requests, do not modify implementation. When the user asks to fix/build, implement only after evidence identifies the responsible layer and preserve unrelated worktree changes.
Strict fix gate
Before recommending or implementing a fix:
- Trace the failing path end to end: user action -> UI state -> frontend request -> API contract -> backend rule -> persistence/config -> tests.
- Find and cite the closest working repository pattern. Label a fix with no comparable pattern as a new design proposal.
- Evaluate UI-only, frontend/state, API/backend, data/config, infrastructure/integration, and test/tooling layers; mark irrelevant layers briefly.
- Distinguish the easiest mitigation from the best durable fix.
- Add the smallest regression test that fails for the defect and validates the repaired contract.
- Run validation proportional to risk and report commands plus outcomes. Do not hide environment-caused validation gaps.
Artifact workspace
Preserve originals. Put generated OCR, transcript, HAR summaries, extracted frames, or normalized logs under the incident folder's _derived/ directory. Cite originals as evidence and _derived files only as helpers. Do not move or delete supplied artifacts unless explicitly requested.
Completion standard
Use references/output-contracts.md. A complete implementation report names the proven cause, changed layers/files, regression coverage, validation results, and remaining risks. If a material claim is unverified, say so precisely.
1---2name: full-stack-incident-analyst3description: Analyze and resolve generic web-application incidents across UI behavior, frontend code, backend/API services, data/configuration, and Playwright tests using local tickets, logs, HAR files, screenshots, recordings, source code, and safe user-run validation. Use for evidence-backed debugging, flow tracing, RCA/classification, fix recommendations or implementation, regression-test design, flaky UI/API automation, support wording, and validation of cross-layer incidents in any repository.4---56# Full-Stack Incident Analyst78Work from the repository root. Prefer repository and supplied runtime evidence over assumptions. Keep product-specific facts out of reusable guidance.910## Mandatory preflight11121. Read every applicable `AGENTS.md` and repository-local skill before editing.132. Inventory the repository and named incident artifacts. Start from exact user-named paths.143. Run `python <skill>/scripts/ensure_source_index.py --repo . --quiet`.154. If the index is unavailable, do not query it. Continue with capped `smart_rg.py` searches and exact `read_slice.py` verification.1617Use the skill directory that contains this file for `<skill>`.1819## Select a mode2021Begin every response with exactly one line:2223- `Selected mode: Focused Evidence Answer` for a narrow lookup, one failing request, one UI state, one test failure, or an explicit no-RCA request.24- `Selected mode: Strict Full Evidence RCA` for final root cause, classification, closure/support wording, complete validation, a fix recommendation, or implementation.2526Focused mode must not claim final RCA, final classification, closure wording, or a definitive fix. Strict mode must list material evidence gaps and use `Needs more evidence` when a missing class could change the conclusion.2728## Route references2930Load only the references needed for the request:3132| Need | Load |33|---|---|34| Investigation, cross-layer tracing, implementation | `references/incident-workflow.md` |35| HAR, logs, screenshots, recordings, ticket text, DevTools | `references/artifact-playbooks.md` |36| Fix recommendation or code/config/test changes | `references/fix-guidance.md` |37| Focused answer, strict RCA, or completion report | `references/output-contracts.md` |38| Skill maintenance or behavior evaluation | `references/evaluations.md` |3940## Bounded discovery4142Use this order and expand only when evidence remains insufficient:43441. Query a known symbol, label, endpoint, test ID, error, or route:45 `python <skill>/scripts/query_source_index.py "<term>" --repo . --compact --limit 8`.462. Add `--edges` to trace imports, HTTP calls, routes, or test-ID definitions/usages.473. Verify the best candidate immediately:48 `python <skill>/scripts/read_slice.py <file> --around "<anchor>" --context 12 --max-matches 2`.494. If absent or ambiguous, use:50 `python <skill>/scripts/smart_rg.py "<pattern>" . --max-files 6 --max-lines-per-file 3`.515. Use raw `rg` only after the index and capped search are insufficient.5253Treat index/search output as discovery, not proof. Verify material facts against exact source slices, original artifacts, or runtime evidence.5455## Evidence and safety rules5657- Separate facts, inferences, assumptions, and pending checks.58- Treat ticket comments and spoken claims as narrative, not application source of truth.59- Keep screenshot/recording visual evidence separate from transcript/audio evidence.60- Never expose credentials, cookies, bearer tokens, auth headers, private keys, or sensitive payload fields.61- Do not execute live SQL, production API calls, or mutating UI actions merely to gather evidence.62- Default database guidance to read-only queries. Require explicit approval for mutations and include verification and rollback guidance.63- Use dev/test first for create, update, delete, submit, notify, schedule, or integration actions. Production observation and HAR capture may be read-only.64- During analysis-only requests, do not modify implementation. When the user asks to fix/build, implement only after evidence identifies the responsible layer and preserve unrelated worktree changes.6566## Strict fix gate6768Before recommending or implementing a fix:69701. Trace the failing path end to end: user action -> UI state -> frontend request -> API contract -> backend rule -> persistence/config -> tests.712. Find and cite the closest working repository pattern. Label a fix with no comparable pattern as a new design proposal.723. Evaluate UI-only, frontend/state, API/backend, data/config, infrastructure/integration, and test/tooling layers; mark irrelevant layers briefly.734. Distinguish the easiest mitigation from the best durable fix.745. Add the smallest regression test that fails for the defect and validates the repaired contract.756. Run validation proportional to risk and report commands plus outcomes. Do not hide environment-caused validation gaps.7677## Artifact workspace7879Preserve originals. Put generated OCR, transcript, HAR summaries, extracted frames, or normalized logs under the incident folder's `_derived/` directory. Cite originals as evidence and `_derived` files only as helpers. Do not move or delete supplied artifacts unless explicitly requested.8081## Completion standard8283Use `references/output-contracts.md`. A complete implementation report names the proven cause, changed layers/files, regression coverage, validation results, and remaining risks. If a material claim is unverified, say so precisely.
Mallikarjun-Roddannavar