JFR Incident Analysis - Design Workflow Diagram

An agent-executed SRE runbook, delivered as a ZIP. Install by agent-assisted copy or manual copy; no background service.
Read existing S3 recordings. No production SSH, live dump, S3 mutation, or automatic Slack post.
This diagram describes the current SKILL.md and its setup, JFR workflow, and Jira report references; it is not a runtime trace.

Language: explicit preference, saved preference, current message, then OS fallback. Conversation is Chinese or English; Jira is always English.
First use verifies AWS CLI, S3 listing and object reading, and a compatible JDK. Persist successful non-secret settings in <skill-dir>/data/config.json.
Later sessions skip the checklist. Repair only the failing operation; distinguish sandbox access denial from invalid credentials.

Default to America/New_York with the date's DST offset; honor an explicit timezone and clarify ambiguous times. Preserve every window ID.
Search s3://log-offload/jfr/YYYYMMDD/<server>/, with relevant legacy or on-demand fallback. Directory dates do not prove recording coverage.
Report full, partial, missing, or unknown coverage per window. Analyze usable windows independently; disclose missing events and sampling limits.
Inspect CPU, GC, memory, locks, and I/O as relevant. Use streaming extraction for large files; whole-file counts are not per-window statistics.

Run artifacts: <skill-dir>/data/YYYYMMDD/<server>/<run-id>/. Keep originals, validated chunks, assembled JFR, evidence, manifest, and report.
YYYYMMDD is the earliest requested start date for that host in New York time. A unique run ID prevents overwrites; manifests retain all dates and windows.
Deduplicate downloads; avoid double-counting overlapping captures. Never combine different hosts or uncertain JVM lifetimes. Exclude data/ from the ZIP.

Show observations, a timestamped timeline, supported explanations, and limitations before proposing a Jira issue. Use the configured project key and a supported issue type.
An unconfirmed investigation ticket requires a separate explicit request. The ordinary path reports missing proof without asserting a root cause.
If Jira is unavailable, keep the English draft. If creation times out, look up the result; an inconclusive lookup must not cause another create request.
Remind the SRE to reply in the original alert thread with the actual status, supported finding, and verified ticket link if available.