Classify
Identify whether the issue is install, publish, billing, runtime, moderation, account, or infrastructure.
Docs1 2 3 4
Operations
Support runbook
Support playbooks for install failures, creator publish issues, billing readiness, runtime incidents, moderation, and customer-safe responses.
Support triage loop
Check status
Open Admin QA for database latency, failed installs, runtime failures, webhook failures, and recent alerts.
Find audit trail
Use install events, token usage logs, audit logs, webhook events, and runtime invocations as source of truth.
Respond safely
Give remediation steps without exposing creator source, buyer tokens, private storage paths, or secrets.
bash
/admin/qaOperational health, alert summaries, failed installs, runtime failures, webhooks, and DB latency.
bash
/api/healthMachine-readable Cloud Run readiness for uptime checks and database probe status.
bash
/admin/securityToken status, revocation/suspension, risky sync failures, and token lifecycle actions.
bash
/adminListing review queue, creator verification requests, abuse reports, and moderation audit trail.
Severity guide
SEV1Public install or checkout is broadly down.Alert admin, freeze risky deploys, check Cloud Run, DB, Stripe webhooks, and sync errors.
SEV2A major creator/buyer flow is failing for many users.Check recent deploys, admin QA, logs, and failed install/runtime buckets.
SEV3Single package, token, creator, or buyer issue.Use package audit, token lifecycle, install events, and creator/buyer account records.
SEV4Question, documentation gap, or onboarding help.Reply with docs, collect missing details, and update support docs if repeated.
Install failure
Check `InstallEvent`, `TokenUsageLog`, token status, requested target, OS/arch, package version, manifest, artifact, checksum, and adapter warnings. Ask the buyer for `oly doctor` and `oly verify` output with secrets removed.
Creator publish blocked
Review draft validation, selected GitHub files, package type, install target, public metadata, media links, artifact creation, security blockers, and admin feedback.
Billing or payout issue
Check monetization flags, Stripe customer/account ids, Checkout session id, Purchase, platform fee, creator net, webhook status, and payout readiness. Do not promise payout timing unless Stripe Connect status is charges and payouts enabled.
Security or abuse report
Move package to review when necessary, inspect public metadata and audit logs, preserve evidence, avoid source leakage, and record all admin decisions with notes.
Database pressure
Check Admin QA latency, Cloud Run logs, connection retries, failed sync spikes, slow pages, and recent deploys. Reduce traffic or scale database before retry storms grow.
Notification issue
Check `EMAIL_NOTIFICATIONS_ENABLED`, `RESEND_API_KEY`, email audit logs, skipped email reasons, Admin QA email delivery health, admin recipient config, and whether the event also wrote a user audit log. Email delivery failures write ops audit alerts instead of sending recursive email alerts when the email provider itself is failing.
Escalation evidence checklist
Install failedPackage slug, version, target, OS/arch, CLI version, error code, InstallEvent id, token status, and sanitized `oly doctor` / `oly verify` output.Never ask for the raw access token, local `.oly/secrets.local.json`, private artifact payload, or user API keys.
Checkout failedCheckout session id when available, buyer email, product id, listing id, Stripe webhook event id, purchase status, connected account readiness, and Admin QA alert timestamp.Never ask for card data, Stripe secret keys, webhook signing secret, or full raw Stripe payload in public channels.
Runtime failedInvocation id, capability slug, client name, runtime status, safe error code, duration, entitlement status, and Cloud Run revision.Never request creator prompts, private source, workflow internals, package ciphertext, or creator secrets.
Publish blockedListing id, package type, wizard step, source mode, selected file count, security audit blockers, admin review notes, and artifact/manifest readiness.Never ask the creator to paste private repository contents into chat unless support has moved to an approved private channel.
Moderation reportReport id, target type, public target excerpt, reporter id, target author id, decision notes, and whether content was hidden.Never expose reporter private contact details or protected source while resolving public content reports.
Install issue
Thanks. Please send package slug, target client, OS, CLI version, the exact error code, and sanitized `oly doctor` plus `oly verify <package>` output. Do not send your access token or local secrets.
Billing issue
Thanks. Please send the listing name, account email, approximate checkout time, and checkout session id if visible. Do not send card details, Stripe secrets, or screenshots containing full payment information.
Runtime issue
Thanks. Please send the capability slug, client name, invocation id, timestamp, and safe error code. We can inspect safe logs and entitlement status without exposing creator source.
Creator publish issue
Thanks. Please send package type, source mode, failing wizard step, and the validation message. Your draft should remain recoverable; do not clear browser storage unless we ask.
Safe to ask for
Package slug, package version, install target, operating system, CLI version, and client name.
Error code, timestamp, invocation id, checkout session id, or admin review id.
Sanitized `oly doctor`, `oly verify`, and safe runtime logs.
Creator package type, source mode, selected file count, and failing wizard step.
Never request publicly
Access tokens, creator secrets, buyer API keys, OAuth tokens, or `.env` files.
Private repository URLs, clone URLs, GitHub installation tokens, or source bundles.
Package ciphertext, IV, auth tag, storage key, encryption key, or signing secret.
Raw protected prompts, private workflow graphs, premium MCP config internals, or creator-only logs.