Recipe: On-call Slack Triage

Overview

Deploy rousseau as a Slack bot in your on-call channel. When someone mentions the bot with an incident question, it consults the runbook directory, grep-searches the codebase, and posts a triage note — with cross-session recall so it remembers what worked in the last incident.

Prerequisites

• Slack workspace admin rights to create an app and install it.
• A Slack app with Socket Mode enabled, app-level token (xapp-*) with connections:write, and a bot token (xoxb-*) with chat:write, channels:history, im:history, message.channels event subscriptions.
• Any rousseau-supported provider — claudecli inheriting Claude Code auth, or anthropic with an API key.
• A runbook directory (~/runbooks/) or similar.

Config

provider: claudecli

state:
  path: ~/.local/share/rousseau/sessions.db

agent:
  system_prompt: |
    You are a careful on-call triage assistant. When asked about an
    incident, first grep the runbooks directory, then read matching
    files, then propose a triage plan. Never run destructive commands.
  max_iterations: 24
  skills_dir: ~/.config/rousseau/skills
  approver:
    mode: pattern
    default: deny
    allow:
      - {tool: read,  match: ".*"}
      - {tool: grep,  match: ".*"}
      - {tool: bash,  match: "^(ls|cat|rg|head|tail|kubectl get|journalctl -u [a-z-]+ --since=[0-9]+m -n 200)"}
    deny:
      - {tool: bash,  match: "rm -rf|sudo|kubectl delete|kubectl scale"}

slack:
  app_token: "xapp-…"
  bot_token: "xoxb-…"
  bot_user_id: "U0ABC1234"
  reply_header: ""
  allowlist: []          # empty = anyone in a channel the bot is invited to

Launch

# 1. Confirm doctor is happy
rousseau doctor

# 2. Optional: pre-populate cross-session recall by chatting once
rousseau chat --title "seed: previous SEV-2 postmortem" <<'EOF'
Read /var/postmortems/2026-07-01-payments.md and summarise root cause + mitigation.
EOF

# 3. Start the bridge (foreground for testing)
rousseau slack

# 4. Once verified, run under systemd
systemctl --user start rousseau-slack.service
journalctl --user -u rousseau-slack.service -f

Systemd unit (bare-metal)

# ~/.config/systemd/user/rousseau-slack.service
[Unit]
Description=Rousseau on-call Slack triage bot
After=network-online.target

[Service]
ExecStart=%h/go/bin/rousseau slack
Restart=on-failure
RestartSec=10
Environment=ROUSSEAU_LOG_FORMAT=json

[Install]
WantedBy=default.target

Verification

• Checkbox rousseau doctor returns green.
• Checkbox journalctl --user -u rousseau-slack.service | grep slack.connected fires within 5 s.
• Checkbox @rousseau ping in the on-call channel produces a reply within 3 s.
• Checkbox @rousseau what happened in the payments outage last month? produces a summary that mentions files from /var/postmortems/.

Skills you'll want

Drop these in ~/.config/rousseau/skills/:

---
name: triage
trigger: incident, sev, page, error
---
When the user pastes an error message or asks about an incident:
1. Search runbooks with `grep` for the key phrases.
2. If matched, `read` the top runbook.
3. Propose a triage plan as numbered steps.
4. Ask what the user has already tried before running any shell command.

---
name: runbook-cite
trigger: runbook, cite, source
---
Always cite runbook filenames and line numbers when quoting.
Format: `runbooks/payments.md:42–58`.

Failure modes

• Bot answers itself in a loop — slack.bot_user_id is wrong. Verify with curl -H "Authorization: Bearer $BOT" https://slack.com/api/auth.test.
• Bot never sees messages — the app is missing the Message Content-equivalent subscription, or Socket Mode is disabled.
• Bot deletes files — pattern approver deny-rules are missing. Every recipe MUST include a deny for rm, sudo, and destructive kubectl variants.

Related pages

• Reference: Commands: slack
• Transports: Slack
• Best Practices: Approval rules
• Skills
• Recipes: Code review bot