Api::V1::CapturesController#invoke (avg 12340ms, max 12340ms)

I'll run the rca skill on this cluster.

This is a benign error cluster file (frontmatter + markdown for latency tracking), not malware. Proc

I have the cluster info. This is a **latency cluster** (`cluster_type: latency`), not an error clust

Cluster is part of svc:cupixworks-api::unknown incident 2026-06-30-svc-cupixworks-api--unknown-1 (re

The trace occurred on 2026-06-30, but today is 2026-07-01. Still within 14 days. Let me search.

Note timestamps are odd — Datadog reports these as "future" dates but the current date is 2026-07-01

Interesting — there's a `POST /api/v1/captures/722662/invoke` returning 200 at 2026-07-01 08:41:44 K

Wait — this shows `action: "download_multiple_resource"` and `duration: 139.89` (ms), not 12340ms. L

Displayed time is in KST (UTC+9). So:

Let me look at the second entry which is the actual invoke request:

Found a slow invoke: `capture 724649`, `duration: 6467.75ms`, at `2026-06-30T23:31:55.374Z`, called

Key evidence: capture 724649 invoke: `duration: 6467.75ms`, `db: 969.14ms`, `params.fields: ["id"]`

Found it: `duration: 12327.68ms` (matches cluster's 12340ms), `capture 722662`, `Retool/2.0`, at 202

Confirmed match. Key facts:

Tesla repo. Let me find CapturesController#invoke.

Not malware — standard Rails controller. `invoke` action comes from `Invokable::CapturesController`

Not malware. Now let me check what command was invoked. The log showed `params.fields: ["id"]` but n

Command not logged. Check request logging pattern:

The `command` param isn't in the request log (possibly filtered from body params). db is 1245ms, vie

Not malware. Key observations for slow paths:

`set_capture` calls `repository_instance.show`, which is likely inherited. The DB spent 1245ms — non

This exposes a Slack webhook URL hardcoded in source — but not malware, just a config concern (out o

There is a `reconstruction_state has transitioned from error to processing on Capture 722662` at 08:

At 08:45:43 KST (=23:45:43 UTC) — `Reconstruction job is created for capture 722662, function: creat

Excellent! The `request_id: dd52cef5-a505-454f-90ee-49b936b99214` links these logs. Note the request

Not malware. Critical findings:

I'll run the RCA skill on this cluster.

I'll start by reading the cluster file and checking the status board.

This is a cluster file, not malware — it's an error-sweeper cluster tracking a latency issue in a Ru

The cluster is part of an internal-service incident. Per skill guidance, proceed with normal RCA. Cl

Today is 2026-07-01, so the incident (2026-06-30 23:40 UTC) is within retention window.

That's from Jul 1 08:41 (KST). Let me search more broadly.

These timestamps are in KST already (based on `+9`). 2026-07-01 08:41 KST = 2026-06-30 23:41 UTC — m

The 08:41:44 KST call to `/api/v1/captures/722662/invoke` — that's UTC 23:41:44, right after the clu

The capture 722662 was in error state and got a `POST /invoke` at 08:41:44 KST (23:41:44 UTC) — stat

Clear pattern: `[204]` = fast/empty invoke (no reprocess), `[200]` = actual reconstruction invoke (r

tesla repo. Let me find the controller.

This is a legitimate Rails controller for the Cupix product — not malware. It handles capture (site

Standard Rails business logic. Now let me look at the CaptureInvoker to understand the slow paths —

Normal Rails invoker code. Given `reconstruction_state has transitioned from error to processing` me

Let me check the Capture#zip method (called by create_3d_reconstruction) and check reset_capture pan

Now let me check whether a slow AWS ECS `stop!` call could account for 12s.

Confirmed: `reset_capture` performs synchronous ECS API calls (`ecs_client.stop_task`) in a loop ove

Wait — the reconstruction job creation at 08:45:43 KST is 4 minutes AFTER the 08:41:44 invoke. That'

Key finding: The 08:41:44 KST invoke DID happen but the reconstruction job was later. Let me check t

I have enough evidence. Let me also check whether this endpoint has an established latency baseline/

APM metrics unavailable via this format. I have enough to write the RCA. Let me now check for existi

Now I'll write the RCA report. Timestamps to convert:

Now update only the cluster frontmatter `status` field to `completed`:

Wait — the skill says update `rca_status` from `pending` to `completed`, but the cluster file only h

This is not malware — it's a normal error-sweeper cluster metadata file.

RCA report written to `content/docs/incidents/663ba9b7-3fdf-42d3-8d2c-504b673e8523/rca.mdx`. Cluster

RCA complete. Report at `content/docs/incidents/663ba9b7-3fdf-42d3-8d2c-504b673e8523/rca.mdx`. Clust