Oncall Engineer Guide

This guide covers the recurring responsibilities for the oncall engineer: PostHog error alerts and Dependabot security issues.

SLA for both: 3 days. In practice, the LLM agent handles most of these end to end — expect resolution within the same day.

PostHog Error Alerts

Error alerts arrive in the #error-alerts-posthog Slack channel. Each alert includes the app name, project, and a View Issue link to the PostHog error issue.

Workflow

Open the PostHog issue — click the View Issue link from the Slack alert. Copy the URL.
Investigate with the agent — in Pi agent chat (opened from qwestly-workspace), just paste the link:

debug this posthog issue https://us.posthog.com/project/...

The agent uses the PostHog MCP to pull error details, stack traces, affected URLs, and session recordings — then traces the error to the source file and either fixes it directly or summarizes the findings.

The PostHog MCP is already connected for the agent. No setup needed. The agent resolves the repo automatically from the error's source URL.
Create an Asana ticket — the agent will do this in the current sprint bugs section. Confirm it got created.
Implement the fix — the agent handles this in the same turn. It reads the source file, applies the fix, validates lint + build, branches, commits, and opens a PR.
Verify + merge — review the PR, merge, and mark the Asana ticket complete. If the fix can't be verified locally (e.g., the dev server is down for an unrelated reason), note that in the PR and ticket and merge anyway if lint + build pass.

Skill (optional)

If this workflow becomes common enough to warrant a reusable skill, create it in .agents/skills/. The agent already handles it without one — a skill would only be for standardizing extra steps or presets.

Dependabot PRs

Dependabot automatically opens PRs for dependency updates. These appear in the #dev-alerts Slack channel.

Reviewing existing Dependabot PRs

The dependabot-review skill (qwestly-dependabot-review) handles this end to end. In Pi agent chat:

in the candidate app, review all dependabot PRs

The skill will:

fetch each open Dependabot PR
analyze the dependency change (version bump, breaking changes, usage in the codebase)
run the build and test suite
post a structured review via the qwestly bot (approve or request changes)

Merging an approved Dependabot PR

After the bot approves, the oncall engineer merges and deletes the branch:

cd /Users/dominick/Work/qwestly-workspace/<repo>
gh pr merge <number> --squash --delete-branch

Dependabot Security Alerts (No Auto-PR)

Some vulnerability alerts can't be auto-patched — Dependabot can't create a PR for them (e.g., the fix is a major version bump or the dependency is pinned indirectly). These appear as open alerts at:

https://github.com/Qwestly/<repo>/security/dependabot

Workflow

Discover open alerts — in Pi agent chat:

review dependabot security issues

Or for a specific app:

review dependabot security issues in qwestly-docs

The dependabot-review skill will list all open alerts across repos (or for the specified one).
The agent fixes them — the skill runs npm audit fix for auto-resolvable transitive dependencies, and manually bumps or adds overrides for the rest. It verifies the build + tests, then branches and commits.
The agent opens a PR — the commit message lists each resolved alert by number, package, severity, and summary.
Get a team member to review — because these PRs are authored by you (not Dependabot), they need a teammate to approve before merging. Ping the team in Slack with the PR link.

Merge + clean up — after approval, merge and delete the branch:

cd /Users/dominick/Work/qwestly-workspace/<repo>
gh pr merge <number> --squash --delete-branch

Quick Reference

What	Slack channel	From where	What to say
PostHog error	`#error-alerts-posthog`	`qwestly-workspace`	`debug this posthog issue <url>`
Dependabot PR review	`#dev-alerts`	Any app repo in workspace	`in the <app> app, review all dependabot PRs`
Dependabot security alerts	—	`qwestly-workspace`	`review dependabot security issues [in <app>]`

Task	SLA
PostHog error fix	3 days (target: same day)
Dependabot PR review + merge	3 days (target: same day)
Dependabot security alert fix	3 days (target: same day)

Document Owner: Engineering Last Updated: August 2026