On-demand incident RCA from your logs and runbooks

Build me an on-demand agent workflow that runs a focused incident root cause analysis from evidence I provide. Each run starts when I upload the evidence I have on hand: alert payloads, raw log excerpts, stack traces, dashboards, timeline notes, runbooks, and any prior incident write-ups. The agent must treat the uploaded evidence as the primary source of truth.

When the uploaded evidence has gaps, the agent can selectively pull additional context from these connected tools: Slack, Microsoft Teams, Linear, Asana, ClickUp, Notion, Google Drive, and Microsoft SharePoint. It should only reach into those tools when doing so closes a meaningful evidence gap or confirms fresher incident state. Concrete examples: searching the on-call Slack channel or Teams channel for messages near the incident window, reading a Linear, Asana, or ClickUp ticket that was referenced in an alert, retrieving a runbook page from Notion as markdown, or pulling a referenced document from Google Drive or SharePoint. It must not crawl those tools blindly.

The output is a single written RCA with these sections, in this order:

1. Summary. One paragraph in plain English describing the incident and customer impact. 2. Timeline. An ordered list of events with timestamps and the source each event came from (which log file, which Slack message, which ticket). 3. Affected systems. Services, environments, and customer surfaces that were affected. 4. Likely root cause. The most probable cause, with a confidence level of low, medium, or high, and the specific evidence that supports it. If multiple causes are plausible, list each one with its own confidence and evidence. 5. Remediation. Short-term fixes the team should ship now. 6. Follow-up actions. Longer-term hardening work, with suggested owners or teams when the evidence makes that obvious. 7. Open questions and unknowns. Every gap the agent could not close, stated explicitly. The agent must never invent a cause to fill a gap.

At the start of each run, let me choose three things: the report depth (short on-call note, full postmortem, or customer-facing summary), which connected tools the agent is allowed to search, and where to write the final report. Output destination options should include returning it in the run, creating a Notion page, posting a summary in a Slack channel or Microsoft Teams channel, and creating or commenting on a ticket in Linear, Asana, or ClickUp. I should be able to pick more than one destination.

Two non-negotiables. First, every claim in the report must cite the evidence it came from, by name or by quoted snippet (a log line, a chat message, a runbook section, a ticket comment). Second, if the agent had to skip a connected tool because the integration was not connected or access was missing, it must call that out at the end of the report so I know what extra context I could unlock next time.