Incident triage
Turn a small log bundle into structured evidence, a likely cause and explicit uncertainty.
Turn a small log bundle into structured evidence, a likely cause and explicit uncertainty.
Set up the example
Start in a project created with bunx laufwerk@0.0.1-alpha.6 init --example coding. Complete host setup first. Run these commands from the consumer project root. The download contains synthetic fixtures and complete workflow source.
curl -fsSLo workflow-recipes.tar.gz https://www.laufwerk.dev/downloads/alpha6/workflow-recipes.tar.gz
tar -xzf workflow-recipes.tar.gz
mkdir -p laufwerk/workflows
cp workflow-recipes/agents.ts laufwerk/recipe-agents.ts
mkdir -p laufwerk/workflows/incident-triage
sed 's|../../agents|../../recipe-agents|' workflow-recipes/workflows/incident-triage/workflow.ts > laufwerk/workflows/incident-triage/workflow.ts
cp -R workflow-recipes/fixtures/incident ./incident-trial
bun run --cwd laufwerk checkRun it
bunx laufwerk@0.0.1-alpha.6 run incident-triage --input '{"executionKey":"incident-triage-1","source":"incident-trial"}'Expect completed (healthy). Open the run in Studio to read the structured result. It should cite the connection errors and pool-size deployment, distinguish a likely connection-budget problem from a proven root cause, and name missing measurements. The input README explicitly says the logs are synthetic.
During onboarding verification, one model response contained malformed JSON and the run failed without changing the source files. If this happens, inspect the retained response in Studio. Do not treat it as a completed report. A new attempt needs a new execution key; the workflow does not automatically retry.
The Report schema checks the result’s structure. It cannot establish that the reasoning is correct. Review the cited evidence. Four instances with a configured pool of 80 could exceed the database’s usable connection budget; these logs do not prove the actual connection count or the effect of a rollback.
The session uses read-only access and never requests write-back. No remediation or external action is part of this workflow.
How it works
This is the complete workflow. The download provides a Codex agent using the same subscription setup as the starter.
import { Workflow } from "@effect/workflow";
import { Session, Workspace } from "@laufwerk/sdk";
import { Effect, Schema } from "effect";
import { analyst } from "../../recipe-agents";
const Report = Schema.Struct({
summary: Schema.String,
observations: Schema.Array(Schema.Struct({ file: Schema.String, evidence: Schema.String })),
likelyCause: Schema.String,
uncertainty: Schema.Array(Schema.String),
nextChecks: Schema.Array(Schema.String),
});
export const workflow = Workflow.make({
name: "incident-triage",
payload: { executionKey: Schema.String, source: Schema.String },
success: Report, error: Schema.String,
idempotencyKey: input => input.executionKey,
});
export const layer = workflow.toLayer(input => Effect.gen(function* () {
const workspace = yield* Workspace.open({ source: input.source });
return yield* Session.run({
key: "diagnose", agent: analyst, workspace, access: "read-only", output: Report,
prompt: "Investigate the incident using the files in this workspace. Cite exact short evidence excerpts and filenames. Distinguish observed failure, likely cause, and things these logs cannot establish. Keep the report concise: one sentence each for summary and likelyCause, at most four observations, two uncertainties and three nextChecks. Recommend concrete checks before any remediation. Do not modify any files.",
});
}).pipe(Effect.mapError(String)));Use a new execution key for each new attempt. Inspect failed or waiting runs →