Purpose
Use this skill to connect observability to action. Metrics and logs are not enough; each critical user journey needs an SLO, alert, owner, response path, and post-incident learning loop.
SLO Design
Define:
- User journey or system capability.
- SLI: request success, latency, freshness, durability, or job completion.
- SLO target and measurement window.
- Error budget and burn-rate alerts.
- Exclusions with rationale.
- Dashboard and data source.
- Owner and escalation path.
Avoid vanity metrics. Prefer user-visible success and latency over internal counters unless internal counters are the only reliable proxy.
Runbook Requirements
Each runbook should include:
- Symptom and alert name.
- Impacted users or systems.
- First 5-minute checks.
- Triage decision tree.
- Mitigation steps with commands.
- Rollback or failover path.
- Escalation owner.
- Customer/support communication note.
- Postmortem trigger.
Commands must be safe to run or explicitly labeled destructive.
Incident Flow
- Declare severity and incident commander.
- Confirm impact from live evidence.
- Stabilize with the lowest-risk mitigation.
- Communicate status on a fixed cadence.
- Preserve evidence before cleanup.
- Write a blameless postmortem with action items and owners.
Output Shape
service_or_journey:
slo:
alerts:
dashboard_or_queries:
runbook:
escalation:
postmortem_template:
verification: