Automated code investigation

Someone has to read the code at 3am.

Legwork checks out the exact commit that broke and reads the code until it finds the cause. Every claim comes back cited to a line, including the hypotheses it ruled out.

Get started Watch a 23-second investigation
CASE 0427 Closed

High · Payment API

Concurrent cache eviction interrupts active archive reads

The clear path removes the content-addressed store without coordinating with active readers.

Time to answer
23s
Files read
14
Hypotheses
2

Case 0427, as it happened

Twenty-three seconds, replayed at speed. Every step, including the one that went nowhere.

elapsed in the investigation
  1. 00:00

    Resolved payments-api to the deploy that preceded the first alert.

    0fab160216e8

  2. 00:02

    Sandbox created.

  3. 00:04

    Queried Grafana across the incident window. Error rate steps at 14:02; p99 latency unchanged.

  4. 00:07

    Read 14 files across internal/cache and internal/archive.

  5. 00:11
    Ruled out

    Hypothesis: the archive reader leaks file handles under load.

    Handle count is flat across the incident window.

    internal/archive/reader.go:210–244

  6. 00:16

    Hypothesis: cache eviction removes the store while readers still hold open paths.

  7. 00:20
    Confirmed

    The evict path calls os.RemoveAll without coordinating with active readers.

    internal/cache/layers.go:94–107

  8. 00:23

    Sandbox destroyed. Working copy gone.

From alert to answer

Legwork sits between the alert that wakes you and the channel you would have posted in anyway.

  1. Connect

    Point your alerting at Legwork

    Grafana and Sentry post their alerts straight in. Anything else opens a case over the API.

    • Grafana
    • Sentry
    • HTTP

  2. Incident

    A case opens

    Idempotent on your incident key, so a retrying alert cannot open the same case twice.

  3. Investigate

    It reads the code and the telemetry

    Your repository at the exact commit that broke, through a read-only GitHub App. Then logs, metrics, traces, and linked issues from the connections above.

  4. Answer

    The finding lands where you already are

    Root cause, cited evidence, and whatever it could not check — delivered to your channel or signed and posted back to your own endpoint.

    • Slack
    • Discord
    • Email
    • Webhook

POST an incident

curl -X POST https://legwork.dev/api/v1/services/payments-api/incidents \
  -H "Authorization: Bearer $LEGWORK_API_KEY" \
  -d '{"title":"5xx spike on /checkout","severity":"high"}'
#incidents

Legwork App 2:14

High · payments-api · closed in 23s

Concurrent cache eviction interrupts active archive reads

internal/cache/layers.go:94–107

Not verified: production eviction rate was out of scope.