func BuildFlow(cfg FlowConfig) *core.Flow {
    return core.NewFlow("incident-reviewer").
        TriggeredBy(core.Webhook("/hooks/incident")).
        Then(pagerduty.ParseWebhook(pagerduty.ParseWebhookInput{
            RawPayload:      core.InputData("webhook_payload"),
            RawHeaders:      core.InputData("webhook_headers"),
            WebhookSecret:   cfg.WebhookSecret,
            AllowedServices: cfg.AllowedServices,
        }).As("webhook").WithTimeout(30 * time.Second)).
        When(func(s *core.FlowState) bool {
            webhook := core.GetOr(s, "webhook", pagerduty.ParseWebhookOutput{})
            return !webhook.Skipped
        }).
        Then(agent.Node("reviewer", agent.NodeConfig{
            LLM: agent.LLMConfig{
                ProviderType: cfg.LLM.ProviderType,
                BaseURL:      cfg.LLM.BaseURL,
                APIKey:       cfg.LLM.APIKey,
                Model:        cfg.LLM.Model,
                MaxTokens:    cfg.LLM.MaxTokens,
            },
            SystemPrompt:  cfg.SystemPrompt,
            UserPrompt:    core.Output("webhook.UserPrompt"),
            MaxIterations: 30,
            Tools:         buildTools(),
            CostLimits: agent.CostLimits{
                PerRunUSD:  cfg.CostLimits.PerRunUSD,
                PerHourUSD: cfg.CostLimits.PerHourUSD,
                PerDayUSD:  cfg.CostLimits.PerDayUSD,
            },
            Compaction: agent.CompactionConfig{
                ThresholdTokens: 80000,
                KeepRecent:      4,
            },
        }).As("review").WithTimeout(15 * time.Minute)).
        Then(slack.NotifyReport(slack.NotifyReportInput{
            WebhookURL:  cfg.SlackWebhookURL,
            Header:      "Incident Review Complete",
            Label1:      "Incident",
            Value1:      core.Output("webhook.IncidentID"),
            Label2:      "Service",
            Value2:      core.Output("webhook.ServiceName"),
            Body:        core.Output("review.Response"),
            CostUSD:     core.Output("review.TotalCost"),
            Duration:    core.Output("review.Duration"),
            TurnsUsed:   core.Output("review.Iterations"),
            Succeeded:   core.Output("review.Succeeded"),
            LLMProvider: cfg.LLM.ProviderType,
            LLMModel:    cfg.LLM.Model,
            FailHeader:  "Incident Review Failed",
            FailMessage: "The automated review failed. Check Temporal UI.",
        }).WithTimeout(30 * time.Second)).
        EndWhen().
        Build()
}

func buildTools() []agent.Tool {
    return []agent.Tool{
        agent.MCPTool("pagerduty", agent.MCPServerConfig{
            Command: "uvx",
            Args:    []string{"pagerduty-mcp", "--enable-write-tools"},
            Env: map[string]string{
                "PAGERDUTY_USER_API_KEY": os.Getenv("PAGERDUTY_USER_API_KEY"),
            },
            AllowTools: []string{
                "get_incident", "list_alerts_from_incident",
                "list_incident_notes", "list_log_entries",
                "get_past_incidents", "get_related_incidents",
                "list_services", "get_service",
                "list_oncalls", "get_escalation_policy", "get_user_data",
            },
        }),
        agent.MCPTool("atlassian", agent.MCPServerConfig{
            Command: "uvx",
            Args:    []string{"mcp-atlassian"},
            Env: map[string]string{
                "JIRA_URL":             os.Getenv("JIRA_URL"),
                "JIRA_USERNAME":        os.Getenv("JIRA_USERNAME"),
                "JIRA_API_TOKEN":       os.Getenv("JIRA_API_TOKEN"),
                "CONFLUENCE_URL":       os.Getenv("CONFLUENCE_URL"),
                "CONFLUENCE_USERNAME":  os.Getenv("CONFLUENCE_USERNAME"),
                "CONFLUENCE_API_TOKEN": os.Getenv("CONFLUENCE_API_TOKEN"),
            },
        }),
        agent.MCPTool("slack", agent.MCPServerConfig{
            Command: "npx",
            Args:    []string{"-y", "@modelcontextprotocol/server-slack"},
            Env: map[string]string{
                "SLACK_BOT_TOKEN": os.Getenv("SLACK_BOT_TOKEN"),
                "SLACK_TEAM_ID":   os.Getenv("SLACK_TEAM_ID"),
            },
        }),
    }
}

func Run() error {
    cfg := LoadConfig()

    return core.NewWorker().
        WithConfig(core.WorkerConfig{
            TaskQueue:     "incident-reviewer-queue",
            MaxConcurrent: 2,
        }).
        WithFlow(BuildFlow(cfg)).
        WithProviders(
            agent.Provider(),
            pagerduty.Provider(),
            slack.Provider(),
        ).
        WithWebhookServer(":8080").
        WithHealthServer(":8081").
        Run()
}

# [Incident Title]

> **[NEW ISSUE / RECURRING]** | **Urgency**: High | **Status**: Triggered
> **Service**: api-gateway | **ID**: P1234567 | **Since**: 2 minutes ago

## What Do I Do Right Now?
1. Follow the relevant SOP — key steps: check pod logs, verify upstream health
2. Check monitoring dashboard for error rate spike
3. If > 50% error rate, escalate to platform team

## What's Happening?
- API gateway returning 502 errors on /api/v2/users endpoint
- Upstream user-service pods in CrashLoopBackOff
- Blast radius: all authenticated API requests

## Has This Happened Before?
- **Feb 15**: Similar 502 spike, resolved by restarting user-service (12 min)
- **Jan 28**: OOM kill on user-service, resolved by memory limit increase (25 min)
- Pattern: 3rd occurrence in 35 days — root cause is memory leak

## Open Tickets
| Ticket | Summary | Status | Assignee |
|--------|---------|--------|----------|
| PLAT-892 | user-service memory leak | In Progress | @jane |

## Follow-Up
- Prioritize memory leak fix
- Add memory usage alerting threshold at 80%
- Update runbook with OOM-specific recovery steps

env:
  - name: AGENT_PROVIDER_TYPE
    value: "anthropic"
  - name: AGENT_MODEL
    value: "claude-sonnet-4-6"
  - name: ANTHROPIC_API_KEY
    valueFrom:
      secretKeyRef:
        name: llm-credentials
        key: anthropic-api-key