/sap-diagnose

name: sap-diagnose
description: |
  Incident triage orchestrator for SAP support. From a single anchor (time window,
  user, transaction, background job, business-object key, or a known short-dump)
  it fans out across its read-only evidence readers — the internal RFC set (SM13
  update-task failures, SM12 locks, SLG1 application log, SM37 jobs, SMQ tRFC/qRFC
  queues, Gateway/OData error-log preflight) plus the GUI dump reader /sap-st22 —
  correlates the evidence into incident clusters, and
  produces ranked root-cause hypotheses with a recommended fix path. Pass --reader
  <name> (sm13 | sm12 | slg1 | sm37 | smq | gateway | st22) to run one reader standalone and just
  print its evidence. PURE READ-ONLY: never writes to SAP; lock remediation is
  delegated to /sap-sm12 release, stuck-update remediation to manual SM13. With --fix it hands a custom-code-defect
  top hypothesis to /sap-fix-incident (the gated, write-capable companion) —
  diagnose itself still writes nothing. Safe to point at production.
  Prerequisites: a saved /sap-login profile (RFC password); SAP NCo 3.1 (32-bit);
  an active SAP GUI session for the ST22 leg.
argument-hint: "[<natural-language incident>] [--user U] [--tcode T] [--program P] [--job J] [--dump KEY] [--object TYPE:KEY] [--date today|YYYYMMDD] [--time HH:MM] [--window MIN] [--sources a,b] [--reader sm13|sm12|slg1|sm37|smq|gateway|st22] [--depth quick|standard|deep] [--remediate] [--fix] [--connection PROFILE] [--report] [--out PATH]"

SAP Incident Diagnosis Orchestrator

You triage a SAP incident the way a senior support consultant does — but in parallel, with full cross-source correlation. Take one anchor, fan out across the read-only readers, merge their evidence into incident clusters, and report ranked root-cause hypotheses plus the next concrete command. You NEVER modify the SAP system; custom-code fixes are handed to `/sap-fix-incident` (gated), lock release to `/sap-sm12 release` (its own liveness gate + typed confirm), and stuck-update remediation to manual SM13 steps (the diagnose readers are read-only).

Task: $ARGUMENTS

---

Shared Resources

| File | Token / role | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Read-only by construction; remediate handoff respects "ask before mutating". | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | *(rule)* | Applies to the GUI ST22 leg + any downstream fix skill. | | `<SAP_DEV_CORE_SHARED_DIR>/rules/settings_lookup.md` | *(rule)* | Per-key settings merge; per-connection pin resolution. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` | `%%RFC_LIB_PS1%%` | NCo helpers for the anchor server-time read. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_settings_lib.ps1` + `sap_connection_lib.ps1` | *(lib)* | `Get-SapWorkDir`, pinned profile. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_helper.ps1` | *(lib)* | start/step/end logging. | | `<SKILL_DIR>/references/sap_diagnose_anchor_resolve.ps1` | *(helper)* | flags → absolute SERVER-time anchor. | | `<SKILL_DIR>/references/sap_diagnose_correlate.ps1` | *(helper)* | deterministic graph + clustering. | | `<SKILL_DIR>/references/diagnose_evidence_schema.json` | *(schema)* | evidence contract every reader emits. | | `<SKILL_DIR>/references/diagnose_source_matrix.tsv` | *(table)* | anchor-signal → reader set. | | `<SKILL_DIR>/references/sap_diagnose_reader_lib.ps1` | `%%DIAG_READER_LIB_PS1%%` | Reader helpers (anchor, read-table, evidence emit) — dot-sourced by the six RFC reader scripts below. | | `<SKILL_DIR>/references/sap_sm37_read.ps1` | *(reader)* | Background-job reader (TBTCO). | | `<SKILL_DIR>/references/sap_sm13_read.ps1` | *(reader)* | Update-task failure reader (VBHDR + VBERROR). | | `<SKILL_DIR>/references/sap_sm12_read.ps1` | *(reader)* | Lock-entry reader (ENQUEUE_READ). | | `<SKILL_DIR>/references/sap_slg1_read.ps1` | *(reader)* | Application-log reader (BALHDR). | | `<SKILL_DIR>/references/sap_smq_read.ps1` | *(reader)* | tRFC + qRFC reader (ARFCSSTATE narrow; TRFCQOUT/TRFCQIN aggregated per queue). | | `<SKILL_DIR>/references/sap_gateway_read.ps1` | *(reader)* | Gateway/OData error-log preflight (NOT_APPLICABLE vs COULD_NOT_CHECK; full read owned by /sap-gateway-service). |

**Evidence readers.** The six RFC readers (SM13 / SM12 / SLG1 / SM37 / SMQ / GATEWAY) are **internal to this skill** — the `references/sap_*_read.ps1` scripts above, run directly in Step 4 (they were formerly the standalone `/sap-sm13` … `/sap-sm37` skills, folded in here to shrink the catalogue). The **GUI dump reader stays a separate skill**, `/sap-st22` (called via the Skill tool), because it drives ST22 through GUI scripting. `/sap-trace` (performance) is likewise separate and is not auto-chained.

**Fix hand-off** (Step 8.5, only with `--fix`): `/sap-fix-incident` — the write-capable companion. Diagnose stays read-only; it only invokes the fix skill (which owns its own confirmation gate + guard rails) after a confirmation.

---

Step 0 — Resolve Work Directory and Settings

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Resolve the active connection: `--connection` if given, else the AI-session pin in `{work_dir}\runtime\session_registry.json`. Read `log_redact_keys` and the SAP RFC connection keys for that system. Set `{RUN_TEMP}` = the `RUN_TEMP=` value (per-run scratch dir, minted + created by `Get-SapRunTemp` — home of the `_run.json` logging state), `{WORK_TEMP}` = `{work_dir}\temp`, `{RUN_DIR}` = `{WORK_TEMP}\diagnose\<run>`:

cmd /c if not exist "{WORK_TEMP}\diagnose" mkdir "{WORK_TEMP}\diagnose"

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -A