Api::V1::WorkspacesController#show (avg 11449ms, max 11449ms)

I'll run the rca skill to analyze this cluster.

I'll start by reading the cluster file and check for status board context.

This cluster file is a normal error-sweeper cluster definition — a latency cluster for a Rails API e

`svc:` scope with no active incident. Proceed with normal RCA. Note: many recurring `cupixworks-api:

Not malware — this is an internal knowledge memory file about a Rails codebase. Very relevant: laten

The cluster is a latency (trace) cluster, not an error. Let me search APM traces and correlated logs

Now let me find the specific slow trace at 2026-07-16 05:28:57 UTC (14:28:57 KST). The trace ID is 3

Times shown are KST (14:xx). The slow trace is around 14:28:57 KST (05:28:57 UTC). Let me narrow to

Let me search specifically for the slow request with high duration around 05:28:57 UTC.

Found the slow request. Let me get raw data for it.

Excellent — key data:

Only one slow request in 24h — this is a rare tail-latency event, not a sustained issue. Let me chec

Very interesting. Two nearly simultaneous requests to `/api/v1/workspaces/1389` at the exact same se

Not malware — Rails REST controller. Show action goes through `set_workspace` → `repository_instance

Not malware — Rails repository with permission joins. Very heavy `permission_joins` (~5 LEFT JOINs w

Not malware — Rails ORM show pattern. The show issues `permission_joins(default_joins(current_class)

Not malware. `facilities_count` and `archived_facilities_count` attributes are what the slow request

Not malware. `facilities_count` and `archived_facilities_count` are managed by `counter_culture` on

Not malware. `billing_info` calls many methods that may hit the DB (prepaid_credit_balance, ondemand

Not malware. Each of `total_prepaid_credit`, `prepaid_credit_balance`, `ondemand_credit_usage` issue

I'll run the RCA skill on the specified error cluster.

I'll read the cluster file first, then invoke the rca skill.

Note: the system reminder about malware isn't relevant here — this is a normal Rails controller late

I'll start with the status board check, then investigate.

Now let me check the status board, and start exploring in parallel.

No active svc:* incident. Now let me explore the source code and search Datadog logs in parallel.

Now let me look at the controller code and search Datadog logs in parallel.

Not malware — standard Rails controller. Let me search differently and look at the repository/factor

Let me search for slow show requests and read the repository code.

Not malware — legitimate Rails repository code for a real product. Now let me search for slow reques

Not malware — this is standard Rails production application code. Now let me search for slow request

The cluster's time window: `start=1784176080000&end=1784183340000` → let me convert to KST. 17841760

The timestamps are shown in KST (14:xx = 05:xx UTC). Note timestamps are 14:20–14:34 KST = 05:20–05:

Let me look at what makes `#show` slow — the ApiController's before_actions, permission logic.

Not malware — Rails ApiController. Let me check the WorkspaceSerializer for expensive serialization

Not malware. Now I have enough context. Let me check the SetCurrentRequestDetails (auth) and set_cur

I have enough evidence. Note that this is a single one-off slow request (occurrence_count=1), no err

APM trace metrics have zero series — the metric names likely differ. I have enough evidence to write

Timestamp conversion: `2026-07-16T05:28:57.333Z` → KST = 2026-07-16 14:28:57 KST.

RCA report written. Per the user's instruction, I will NOT modify the cluster frontmatter — the pipe

RCA report written to `content/docs/incidents/29a515df-82ca-4b69-95d2-c9868483a31d/rca.mdx`. Cluster