[toasterman234]

Confidence Score: 0/5

This PR needs fixes before merging because sensor runs can lose detections and seed retries can leave historical records unfinished.

Findings

1.  Later incidents are missed ▶
2.  Overlapping runs erase detections ▶
3.  Seed retries skip unfinished records ▶
4.  Recurrences reuse old verification ▶
5.  Historical incidents never load ▶
6.  Empty inputs pass required checks ▶
7.  Proposing a fix creates nothing ▶
8.  Verification accepts unfinished fixes ▶
9.  Selected server is ignored ▶
10.  App violates kernel-only rule ▶

Fix with agent prompt

### Issue 1
os-apps/incident-rca/sensor/file_incident.py:44-46
`file_incident.py` searches only the first page of incidents. The server returns 100 rows by default. When a matching incident is on a later page, the sensor creates another incident instead of reopening or reusing it. `seed_loader.py` has the same problem when checking existing titles.

Follow `@odata.nextLink` before deciding that no match exists.

### Issue 2
os-apps/incident-rca/sensor/tailnet-sensor.py:102-104
If sensor runs overlap during an outage, they can erase undelivered detections. Each run reads the shared queue, keeps its own copy while SSH requests run, then replaces the whole file. If two runs read an empty queue, the second write drops the first run's detection.

Lock the queue across updates and save changes without exposing a partly written file.

### Issue 3
os-apps/incident-rca/seeds/seed_loader.py:63-65
Once creation succeeds, a later action failure leaves that incident unfinished. The next run skips it solely because its title exists, so retrying cannot finish the load. The loader also exits successfully after reporting partial loads.

Resume existing unfinished seeds from their current state and return a failure when any seed fails.

### Issue 4
os-apps/incident-rca/incident.ioa.toml:undefined-127
`Reopen` keeps every flag from the previous closure. After a recurrence, an investigator can run `BeginInvestigation → CompleteDocumentation → StateHypothesis → ProposeFix → BeginVerification → Close` without attaching new evidence, reviewing prior incidents again, or recording new verification. Reset the investigation and verification flags when reopening, while keeping the previous record as history.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 5
os-apps/incident-rca/seeds/tunnel-incidents.json:undefined-1
The installer never reads `seeds/tunnel-incidents.json`. It only loads `seed-data/*.toml` files containing `[[instance]]` blocks, so installing this app creates none of the eight historical incidents promised in `APP.md`. Convert the corpus to the supported seed format and include the actions needed to reach `Closed`.

### Issue 6
os-apps/incident-rca/incident.ioa.toml:83-85
The recording actions set their completion flags even when the caller supplies `{}` or empty strings. Declaring `params` and CSDL `Nullable="false"` does not require content here: the runtime accepts inputs without constraints. An incident can therefore close without evidence or a hypothesis, and a postmortem can enter review without root-cause text.

Add nonempty constraints to the evidence, prior-review, hypothesis, and verification inputs. Apply the same check to `AddRootCause` in the postmortem spec.

### Issue 7
os-apps/incident-rca/incident.ioa.toml:91-96
`ProposeFix` only changes the incident's status. It has no creation effect or trigger, so it never creates the `Remediation` promised by its hint and `APP.md`. Callers reach `FixProposed` with nothing available for a human to approve. Add an explicit step that creates and links the proposed remediation.

### Issue 8
os-apps/incident-rca/incident.ioa.toml:99-104
`BeginVerification` accepts any `RemediationRef` without checking the referenced remediation. For example, `{"RemediationRef":"not-real"}` moves an incident from `FixProposed` to `Verifying`; a failed or rejected remediation works too. The investigator can then advance to closure without a successful fix. Require a remediation linked to this incident that has reached `Succeeded` before allowing this transition.

### Issue 9
os-apps/incident-rca/sensor/tailnet-sensor.py:65-68
`--base` is accepted and passed to `file_incident`, but that function ignores it and always sends detections to the hardcoded Mac over SSH. Someone selecting another server still files to the original deployment, or queues failures if that Mac is unavailable.

Honor the selected destination or remove the misleading option.

### Issue 10
os-apps/incident-rca/app.toml:1-3
This adds an application-specific incident workflow to the kernel repository. The repository guide explicitly requires “Kernel code only” and says app and agent logic belongs in `temperpaw`. The incident state machine and Cedar policies are app behavior, not kernel support. Put the new app bundle in its owning repository before merging to satisfy that requirement.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds an incident investigation workflow with human-approved fixes and postmortems.

Follow-up changes:

• Tunnel failures become incidents that need evidence before closure.
• Fix proposals need human approval before they can be carried out.
• Postmortems move from a root-cause draft to a published record.
• Tunnel faults reach the incident app even when the tunnel is down.
• Observe can be built and run as a production container.
• Observe pages no longer include empty update-time placeholders.

New findings cover incomplete list reads, lost queue updates, unfinished seed retries, and an ignored server option.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Tunnel classifier] --> B{Fault detected?}
  B -->|Yes| C[Detection plus queued items]
  B -->|No| D[Queued items]
  C --> E[SSH to Mac helper]
  D --> E
  E --> F{Delivery succeeds?}
  F -->|No| G[Keep detection in local queue]
  F -->|Yes| H[List incidents]
  H --> I{Matching incident?}
  I -->|Open| J[Reuse incident]
  I -->|Closed| K[Reopen incident]
  I -->|None| L[Create incident]

Loading

_{Reviews (2) · Last reviewed commit: "As-built updates: operator identity in C..." · Reviewed by Greptile}

[greptile-apps]

Recurrences reuse old verification

Reopen keeps every flag from the previous closure. After a recurrence, an investigator can run BeginInvestigation → CompleteDocumentation → StateHypothesis → ProposeFix → BeginVerification → Close without attaching new evidence, reviewing prior incidents again, or recording new verification. Reset the investigation and verification flags when reopening, while keeping the previous record as history.

Knowledge Base Used: Execution semantics and action evaluation

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/incident.ioa.toml
Line: 127

Comment:
**Recurrences reuse old verification**

`Reopen` keeps every flag from the previous closure. After a recurrence, an investigator can run `BeginInvestigation → CompleteDocumentation → StateHypothesis → ProposeFix → BeginVerification → Close` without attaching new evidence, reviewing prior incidents again, or recording new verification. Reset the investigation and verification flags when reopening, while keeping the previous record as history.

**Knowledge Base Used:** [Execution semantics and action evaluation](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/execution-semantics.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Historical incidents never load

The installer never reads seeds/tunnel-incidents.json. It only loads seed-data/*.toml files containing [[instance]] blocks, so installing this app creates none of the eight historical incidents promised in APP.md. Convert the corpus to the supported seed format and include the actions needed to reach Closed.

Knowledge Base Used: Platform lifecycle and deployment

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/seeds/tunnel-incidents.json
Line: 1

Comment:
**Historical incidents never load**

The installer never reads `seeds/tunnel-incidents.json`. It only loads `seed-data/*.toml` files containing `[[instance]]` blocks, so installing this app creates none of the eight historical incidents promised in `APP.md`. Convert the corpus to the supported seed format and include the actions needed to reach `Closed`.

**Knowledge Base Used:** [Platform lifecycle and deployment](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/platform-lifecycle.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Empty inputs pass required checks

The recording actions set their completion flags even when the caller supplies {} or empty strings. Declaring params and CSDL Nullable="false" does not require content here: the runtime accepts inputs without constraints. An incident can therefore close without evidence or a hypothesis, and a postmortem can enter review without root-cause text.

Add nonempty constraints to the evidence, prior-review, hypothesis, and verification inputs. Apply the same check to AddRootCause in the postmortem spec.

Knowledge Base Used:

• Specification authoring and compilation
• Execution semantics and action evaluation

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/incident.ioa.toml
Line: 83-85

Comment:
**Empty inputs pass required checks**

The recording actions set their completion flags even when the caller supplies `{}` or empty strings. Declaring `params` and CSDL `Nullable="false"` does not require content here: the runtime accepts inputs without constraints. An incident can therefore close without evidence or a hypothesis, and a postmortem can enter review without root-cause text.

Add nonempty constraints to the evidence, prior-review, hypothesis, and verification inputs. Apply the same check to `AddRootCause` in the postmortem spec.

**Knowledge Base Used:**
- [Specification authoring and compilation](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/specification-authoring.md)
- [Execution semantics and action evaluation](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/execution-semantics.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Proposing a fix creates nothing

ProposeFix only changes the incident's status. It has no creation effect or trigger, so it never creates the Remediation promised by its hint and APP.md. Callers reach FixProposed with nothing available for a human to approve. Add an explicit step that creates and links the proposed remediation.

Knowledge Base Used: Specification authoring and compilation

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/incident.ioa.toml
Line: 91-96

Comment:
**Proposing a fix creates nothing**

`ProposeFix` only changes the incident's status. It has no creation effect or trigger, so it never creates the `Remediation` promised by its hint and `APP.md`. Callers reach `FixProposed` with nothing available for a human to approve. Add an explicit step that creates and links the proposed remediation.

**Knowledge Base Used:** [Specification authoring and compilation](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/specification-authoring.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Verification accepts unfinished fixes

BeginVerification accepts any RemediationRef without checking the referenced remediation. For example, {"RemediationRef":"not-real"} moves an incident from FixProposed to Verifying; a failed or rejected remediation works too. The investigator can then advance to closure without a successful fix. Require a remediation linked to this incident that has reached Succeeded before allowing this transition.

Knowledge Base Used:

• Specification authoring and compilation
• Execution semantics and action evaluation

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/incident.ioa.toml
Line: 99-104

Comment:
**Verification accepts unfinished fixes**

`BeginVerification` accepts any `RemediationRef` without checking the referenced remediation. For example, `{"RemediationRef":"not-real"}` moves an incident from `FixProposed` to `Verifying`; a failed or rejected remediation works too. The investigator can then advance to closure without a successful fix. Require a remediation linked to this incident that has reached `Succeeded` before allowing this transition.

**Knowledge Base Used:**
- [Specification authoring and compilation](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/specification-authoring.md)
- [Execution semantics and action evaluation](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/execution-semantics.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

App violates kernel-only rule

This adds an application-specific incident workflow to the kernel repository. The repository guide explicitly requires “Kernel code only” and says app and agent logic belongs in temperpaw. The incident state machine and Cedar policies are app behavior, not kernel support. Put the new app bundle in its owning repository before merging to satisfy that requirement.

Context Used: CLAUDE.md (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/app.toml
Line: 1-3

Comment:
**App violates kernel-only rule**

This adds an application-specific incident workflow to the kernel repository. The repository guide explicitly requires “Kernel code only” and says app and agent logic belongs in `temperpaw`. The incident state machine and Cedar policies are app behavior, not kernel support. Put the new app bundle in its owning repository before merging to satisfy that requirement.

**Context Used:** CLAUDE.md ([source](https://github.com/nerdsane/temper/blob/main/CLAUDE.md))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Later incidents are missed

file_incident.py searches only the first page of incidents. The server returns 100 rows by default. When a matching incident is on a later page, the sensor creates another incident instead of reopening or reusing it. seed_loader.py has the same problem when checking existing titles.

Follow @odata.nextLink before deciding that no match exists.

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/sensor/file_incident.py
Line: 44-46

Comment:
**Later incidents are missed**

`file_incident.py` searches only the first page of incidents. The server returns 100 rows by default. When a matching incident is on a later page, the sensor creates another incident instead of reopening or reusing it. `seed_loader.py` has the same problem when checking existing titles.

Follow `@odata.nextLink` before deciding that no match exists.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Overlapping runs erase detections

If sensor runs overlap during an outage, they can erase undelivered detections. Each run reads the shared queue, keeps its own copy while SSH requests run, then replaces the whole file. If two runs read an empty queue, the second write drops the first run's detection.

Lock the queue across updates and save changes without exposing a partly written file.

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/sensor/tailnet-sensor.py
Line: 102-104

Comment:
**Overlapping runs erase detections**

If sensor runs overlap during an outage, they can erase undelivered detections. Each run reads the shared queue, keeps its own copy while SSH requests run, then replaces the whole file. If two runs read an empty queue, the second write drops the first run's detection.

Lock the queue across updates and save changes without exposing a partly written file.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Seed retries skip unfinished records

Once creation succeeds, a later action failure leaves that incident unfinished. The next run skips it solely because its title exists, so retrying cannot finish the load. The loader also exits successfully after reporting partial loads.

Resume existing unfinished seeds from their current state and return a failure when any seed fails.

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/seeds/seed_loader.py
Line: 63-65

Comment:
**Seed retries skip unfinished records**

Once creation succeeds, a later action failure leaves that incident unfinished. The next run skips it solely because its title exists, so retrying cannot finish the load. The loader also exits successfully after reporting partial loads.

Resume existing unfinished seeds from their current state and return a failure when any seed fails.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Selected server is ignored

--base is accepted and passed to file_incident, but that function ignores it and always sends detections to the hardcoded Mac over SSH. Someone selecting another server still files to the original deployment, or queues failures if that Mac is unavailable.

Honor the selected destination or remove the misleading option.

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/incident-rca/sensor/tailnet-sensor.py
Line: 65-68

Comment:
**Selected server is ignored**

`--base` is accepted and passed to `file_incident`, but that function ignores it and always sends detections to the hardcoded Mac over SSH. Someone selecting another server still files to the original deployment, or queues failures if that Mac is unavailable.

Honor the selected destination or remove the misleading option.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.