Hourly PostHog error spike alerts in Linear and Slack

Every hour, scan PostHog for new or spiking frontend exceptions and turn them into actionable Linear tickets for the engineering team. Build this as an agent workflow because the model has to deduplicate similar errors, write a useful ticket summary, and pick the most representative session replay.

Trigger: cron, every hour on the hour.

Step 1. Pull recent exceptions from PostHog. Use PostHog Execute HogQL Query to query $exception events from the last 60 minutes. Group results by the error message and the top stack frame (file plus function plus line). For each group return the error fingerprint, the count, up to 25 affected distinct_ids, and a breakdown of browser and OS.

Step 2. Pull the 24-hour baseline. Run a second HogQL query over the previous 24 hours (excluding the last hour), grouped the same way, to get the average hourly baseline count per fingerprint.

Step 3. Flag what matters. For each fingerprint, decide whether to alert. Tag it New if the fingerprint did not appear in the 24-hour baseline at all. Tag it Spike if the last-hour count is more than 3x the average hourly baseline. Skip everything else.

Step 4. Grab a representative session replay. For each flagged fingerprint, call PostHog List Session Recordings filtered by the affected distinct_ids from step 1. Let the agent pick the most useful single recording (prefer recent, longer duration, has console errors) and grab its URL.

Step 5. Check Linear for duplicates. Before filing, search Linear for an open issue whose title matches the error message or fingerprint. If one exists, add a comment with the new hourly count, affected user count, and replay link instead of creating a duplicate.

Step 6. File a Linear issue per new flagged group. Use Linear Create Issue in the engineering team's bug project. Title is the error message, truncated to a sane length. Description (markdown) includes the top stack frame snippet in a code block, the affected user count, the browser and OS breakdown, the New vs Spike tag, the session replay link, and a link back to the underlying PostHog query. Set priority Urgent for spikes that affect more than 50 users in the hour, High otherwise. Apply labels frontend, exception, and either new-error or spike.

Step 7. Post a heads-up to Slack. Use Slack Bot Send a Message to post to the engineering-bugs channel. One short summary message per ticket with the error message, the affected user count, the new Linear issue URL, and the replay link. If more than three new tickets fired this hour, post a single roll-up message that links each one.

Important agent behavior. Deduplicate similar errors that differ only in template strings, request IDs, or other dynamic values. Always include the replay URL in the ticket body. If a flagged fingerprint already has an open Linear ticket, comment, do not refile. If the same error appears every hour for hours on end, keep commenting on the same issue and stop pinging Slack after the first alert that day.