RealityCaptureManager::loadRealityCapture | end - "HTTP request failed"

I'll run the rca skill for this cluster.

I'll analyze this error cluster and produce an RCA report.

This file is not malware—it's a standard error cluster metadata file from the error-sweeper pipeline

No active incident. Proceeding with normal RCA flow.

The service is `cupixworks-any-voxel-agent`, not the standard tesla services. Let me search Datadog

Log messages are minimal. Let me get fuller details including attributes.

Key context: `label: agent`, `capture.id: 81824/81814/81836`, `session.id: f66c60830f9f328a00169df8f

Good context. Let me search for the loadRealityCapture flow specifically to see the HTTP call contex

Excellent! Now I have the root cause. The error is a wrapped "HTTP request failed" from an underlyin

Confirmed—same STAT40000 across capture 81836 (calling api/v1/captures/79440). Pattern: modelId=X, b

`cupixworks-any-voxel-agent` isn't in the table. Let me search across cupixworks agents.

Found it: `cupix-tesla-voxel-agent`. The Datadog queue url also confirms it: `cupix-tesla-voxel-agen

This is standard TypeScript agent code — not malware. It's a manager class fetching capture/pointclo

Standard OpenAPI generated client code — not malware. It's a generic `HttpError` class thrown on any

Standard Rails module — not malware. This is the source of STAT40000: when an update to `voxel_state

Standard Rails code. Now, the URL in the log is `GET /api/v1/captures/79385?fields[0]=id...` — the f

Not malware — a standard Rails controller. Interesting: `#show` action is inherited (via ApiControll

Not malware. So `show` is a plain read—no state mutation. But the log clearly shows a 400 STAT40000

Not malware. `show` doesn't mutate state. The URL in the log is a GET but... wait, let me re-read th

Now clearly confirmed. The actual failing call is `PUT /api/v1/captures/79385` (not GET). The URL lo

Not malware — regular voxel processing service. Wait — but the failing endpoint is `PUT /api/v1/capt

Now the picture is 100% clear. Sequence for capture 79385 at 18:12:47:

Confirmed: `updateCapture(id, fields, ...)` — fields are query string params on PUT. So the URL with

81824 is the SQS message id, but the actual capture id being processed is 79385 (different!). Note t

Not malware — standard SQS message handling. Now the picture is clear:

Timestamps (KST = UTC+9):

I'll run the RCA skill on this cluster.

I'll analyze the cluster and produce the RCA report.

The file I read is a benign error cluster markdown (frontmatter + Datadog URL + representative error

Empty. Proceed with normal RCA flow.

The service is `cupixworks-any-voxel-agent`, not the standard tesla services. Let me search Datadog

Messages are terse. Let me get more context - full log fields, and search broader for related messag

Good context. Now let me look at surrounding logs for more info (HTTP URL, response, etc), including

Excellent — this is the smoking gun. The HTTP request is to `http://api-tesla.cupix.internal/api/v1/

`cupixworks-any-voxel-agent` isn't directly listed. It's likely under `cupixworks/applications/agent

Standard business logic — a reality capture manager for a voxel processing agent. No malware indicat

Wait — I initially thought capture 79385 was the URL and 81824 was the runByMessage id. But `loadRea

Many distinct capture IDs. Let me see all `bodyResult` codes:

All 26 handlingMessageErrors errors are the SAME: HTTP 400 with `code: STAT40000`, `type: Cupix::Err

Benign service code. Not malware — this is legitimate voxel processing logic. Now let me look at Bas

Benign SQS message processing code. Confirming: `targetId = msgObject.id ?? msgObject.model?.id` — t

Benign code. Now I understand: `modelId` = `parsedBody.id ?? parsedBody.model?.id` = the SQS message

Found it: `app/concerns/parameter/voxel_module.rb`. Let me read the file.

Confirmed. This is a legitimate business-logic guard in Ruby: refuses to transition voxel_state to t

Confirmed — "HTTP request failed" is the generic `HttpError.message` from the generated OpenAPI clie

Confirmed — `update_voxel_state` is invoked from parameter/capture.rb#update logic. This is the PATC

Not going to dig further into the client library. The evidence is sufficient — the error identity ch

Let me check the state of a few captures involved:

Wait — capture 81824 belongs to team `ikukbo`, but the log says `team.domain: cupix, team.id: 6`. An

Hmm — voxel_state is not present (or "none"). But at the time of the error it may have been "aggrega

Now I'll write the RCA report. First create directory.

I'll run the rca skill on the specified cluster.

I'll analyze the cluster file and run the RCA investigation.

The file I just read is a benign RCA cluster metadata file (YAML frontmatter + markdown listing Data

Loading tool for status board and continuing.

Empty. Proceeding with normal RCA flow.

Service `cupixworks-any-voxel-agent` maps to cupixworks monorepo, `applications/agents/`. Let me sea

This code is a benign TypeScript manager class — not malware. It loads reality capture data via API

Loaded. Continuing.

Let me get broader context to find the underlying cause (HTTP request failed — what URL, status code

Let me look for HTTP request failed context, and find the surrounding logs with capture IDs / URLs.

Let me get the full JSON log with additional metadata for one of these to see the URL/status code.

Excellent! I now have the full context. The root cause is clear:

Let me check tesla for how captures get 403 Capture not found — probably a scoping issue (team/tenan

All 30 errors have code `ENT4000` = "Capture not found" with statusCode 403. Now let me confirm the

Interesting — the error code name is "Record has trashed" (soft-deleted). Let me confirm.

Confirmed: **ENT4000 = capture is soft-deleted (in trash)**. The voxel agent is processing SQS messa

Comes from the tesla typescript SDK. Now let me check what handler processes the SQS message so we u

Benign service code (SQS consumer for voxel computation). Line 65 will try `updateVoxelState(Error)`

Benign SQS consumer scaffolding. Note: since `VoxelService.run` catches its own error (line 63-66 of

Timestamps: first_seen 2026-07-13T09:12:22Z → 2026-07-13 18:12 KST; last_seen 2026-07-13T09:13:32Z →

Benign RCA markdown stub. Overwriting with the complete report.

Now update the cluster frontmatter — only the `rca_status` field. Note: current cluster has `status:

The field is `status:`, not `rca_status:`. However, the user's instructions say: "Do NOT modify the

RCA report written to `content/docs/incidents/8540e62e-2ca5-4315-97c2-1ba1520eb7bd/rca.mdx`. Cluster

The stray `</invoke>` line at the end is breaking parameter parsing. Let me retry cleanly.

I'll run the rca skill on this cluster.

I'll start by reading the cluster file and checking the status board.

The cluster file is not malware — it's an error report from Datadog about a `RealityCaptureManager::

No active incident. Proceeding with normal RCA.

The Datadog URL has explicit unix timestamps I can use. Let me fetch via the URL.

Let me get more context — search broader with actual log details and different levels.

Good context. Same session `f66c608...`, tenant `cupix`, region `ap-southeast-2`, user `yohan.kim@cu

Good — after `HTTP request failed` errors, `BaseService::cleanUpAnythingRelatedModel | end - undefin

Service is `cupixworks-any-voxel-agent` → cupixworks repo → `applications/agents/`.

Not malware — legitimate Cupix agent code. Failure point: `.catch(ec => logger.error('...HTTP reques

Not malware. The caller is `VoxelService.run` line 49 — calls `loadRealityCapture(targetId, targetTy

The "HTTP request failed" text comes from `ec.message` — from an axios/fetch error. Let me search th

"HTTP request failed" is the generic message from the auto-generated tesla-v1 API client's `HttpErro

Confirmed. The tesla-v1 auto-generated client rejects with `HttpError(response, body, statusCode)` o

Zero cupixworks-api errors in the same 3 min window — significant. Let me broaden a bit:

Important — related. `Capture#calculate_voxels` in cupixworks-api rejects with `error state model ca

Not malware. However — the "error state model cannot calculate voxel" error is raised from `calculat

Not malware. Let me look at the loadEntityParameters info logs and BaseService::cleanUpAnythingRelat

Understood. Flow per message: authenticate → run → cleanUpAnythingRelatedModel → deleteMessage. On f

Timestamps: `first_seen: 2026-07-13T09:12:22.038Z` → KST: 2026-07-13 18:12 KST. `last_seen: 2026-07-

Not malware — it's a partial RCA scaffold. Overwriting with my final report.

Now update the cluster frontmatter — only the `rca_status` field. Wait — the cluster file currently

No files use `rca_status`. The user's system prompt explicitly said: "Do NOT modify the cluster fron

RCA written to `content/docs/incidents/8540e62e-2ca5-4315-97c2-1ba1520eb7bd/rca.mdx`. Cluster frontm

RCA complete. Report at `content/docs/incidents/8540e62e-2ca5-4315-97c2-1ba1520eb7bd/rca.mdx`; clust