[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-signals-scout-apm":3,"mdc-wx5eex-key":41,"related-repo-posthog-signals-scout-apm":2237,"related-org-posthog-signals-scout-apm":2356},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":36,"sourceUrl":39,"mdContent":40},"signals-scout-apm","monitor PostHog distributed tracing and APM metrics","Signals scout for PostHog distributed tracing (APM \u002F OpenTelemetry spans). Watches RED metrics per (service, operation) — error rate, p95 latency, request volume — for regressions, new error signatures, and traffic cliffs, and files each validated regression as a report in the inbox.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,17,20,23],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"OpenTelemetry","opentelemetry",{"name":21,"slug":22,"type":15},"Distributed Tracing","distributed-tracing",{"name":24,"slug":25,"type":15},"Metrics","metrics",59,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fai-plugin","2026-07-18T05:11:29.451334",null,11,[32,33,34,35],"claude-code-plugin","codex-plugin","cursor-plugin","gemini-cli-extension",{"repoUrl":27,"stars":26,"forks":30,"topics":37,"description":38},[32,33,34,35],"Official PostHog plugin for Claude Code, Cursor, Gemini, Codex and other AI coding tools","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fai-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fsignals-scout-apm","---\nname: signals-scout-apm\ndescription: >\n  Signals scout for PostHog distributed tracing (APM \u002F OpenTelemetry spans). Watches RED\n  metrics per (service, operation) — error rate, p95 latency, request volume — for\n  regressions, new error signatures, and traffic cliffs, and files each validated regression\n  as a report in the inbox.\ncompatibility: >\n  PostHog Signals agent (Claude sandbox). Read-only analytics + signal_scout_internal:write\n  (scratchpad) + signal_scout_report:write (report channel), plus the apm-* tool family\n  (query-apm-spans, apm-trace-get, apm-spans-aggregate, apm-spans-tree, apm-spans-count,\n  apm-spans-sparkline, apm-spans-duration-histogram, apm-attribute-breakdown,\n  apm-services-list, apm-attributes-list, apm-attribute-values-list) and the bundled\n  exploring-apm-traces deep-dive skill.\nallowed_tools:\n  - emit_report\n  - edit_report\nmetadata:\n  owner_team: signals\n  scope: apm\n---\n\n# Signals scout: distributed tracing (APM)\n\nYou are a focused APM scout. Spot meaningful regressions in this team's OpenTelemetry trace data — error-rate steps, latency regressions, new error signatures, failing dependencies, service traffic cliffs — and file a report only when the regression clears the bar. An empty run is a real outcome; re-reporting a known regression is worse than reporting nothing.\n\nYou author reports directly via the report channel (`scout-emit-report` \u002F `scout-edit-report`): you've done the investigation, so you own each report 1:1 end-to-end rather than firing weak signals for a pipeline to cluster. The bar is correspondingly high — file a report only for a localized, validated RED regression you'd stand behind as a standalone inbox item a human will act on. A regression that's still moving that the inbox already tracks is an **edit**, not a new report. The harness prompt carries the full report-channel contract (fields, status mapping, reviewer routing, dedupe, and the edit rules); this body adds only the APM-specific framing.\n\n**This is APM \u002F distributed tracing, not AI observability and not logs.** Ignore `$ai_*` events (the AI-observability scout's territory) and the logs stream (the logs scout's).\n\n**The discriminator: a per-(service, operation) RED regression measured as a _rate_, not a raw total, against that operation's own baseline 7 days ago, while request volume holds steady.** Error _rate_ (`error_count \u002F count`) and p95 _latency_ are the signal; raw error count and raw span count that move in lockstep with traffic are noise. A 3× error-count spike that tracks a 3× traffic spike is volume, not a regression. Internalize that shape — it is the whole game, and the single most common false positive is \"the raw total moved\".\n\n## Quick close-out: is APM even in use?\n\nAPM spans live in their own span store, **not** in the analytics event stream — so `project-profile-get`'s `top_events` will not list them. Use the APM tools to check:\n\n- `apm-services-list` — empty (no service has emitted spans), **and**\n- `apm-spans-count` over the last 24h — ~0,\n\n→ this team isn't using distributed tracing. Write one scratchpad entry:\n\n- key: `not-in-use:apm`\n- content: brief note (\"checked at {timestamp}, apm-services-list empty, 0 spans 24h\")\n\nClose out empty. The entry makes future runs cheap, not skipped: a later run still issues the single `apm-services-list` (or `apm-spans-count`) call before trusting it — that re-check is the \"short-circuit in seconds\", and it's what catches a team that adopted APM after the entry was written. Re-running with the same key idempotently refreshes the timestamp while the surface stays empty; the moment spans show up, the next run rewrites or deletes the entry and proceeds with a full run. Never close out on the memory alone.\n\n## How a run works\n\nCycle between these moves; skip what's not useful, revisit what is. Lean on the bundled `exploring-apm-traces` skill for the actual query shapes, the `kind`\u002F`status_code` enums, and the trace-parsing scripts — don't re-derive them here.\n\n### Get oriented\n\nThree cheap reads cold-start a run:\n\n- `scout-scratchpad-search` (`text=apm`) — durable steering from past APM runs. **Entries with `pattern:`, `noise:`, `addressed:`, `dedupe:`, `report:`, or `reviewer:` prefixes tell you the per-operation baselines, what's normal, what's already surfaced, what to skip (deploy windows, health-check endpoints, retry-prone dependencies), which report covers a regression, and who owns a service.**\n- `scout-runs-list` (last 7d) — what prior APM runs found and ruled out. Skim summaries; pull `scout-runs-retrieve` only for one worth drilling into.\n- `apm-services-list` — the live service inventory. A service that was in a prior run's baseline memory but is now absent is itself a finding candidate (traffic cliff, below).\n- `inbox-reports-list` (`ordering=-updated_at`, `search`=the specific service or operation) — the reports already in the inbox. Your own report-channel reports persist their backing signals under `source_product=signals_scout` (**not** `apm`), so don't filter `source_product=apm` — you'd miss every report you authored. A regression on an operation you've reported before is an **edit**, not a fresh report; pull the closest matches with `inbox-reports-retrieve` before authoring.\n\n### The discriminator engine\n\nOne call gives you the seasonality-matched baseline for every operation:\n\n```json\napm-spans-aggregate\n{\n  \"query\": {\n    \"dateRange\": { \"date_from\": \"-1d\" },\n    \"compareFilter\": { \"compare\": true, \"compare_to\": \"-7d\" }\n  }\n}\n```\n\n`results` is the last 24h, `compare` is the same 24h one week ago — both as one row per `(service_name, name)` with `count`, `error_count`, `p50_duration_nano`, `p95_duration_nano`. Join the two arrays on `(service_name, name)` and compute, per operation:\n\n- **error rate** `error_count \u002F count`, now vs 7d-ago\n- **p95 latency** `p95_duration_nano`, now vs 7d-ago\n- **request volume** `count`, now vs 7d-ago (the denominator guard)\n\nA busy service returns hundreds of operations (the payload runs to 100KB+ and the harness persists it to a file) — **process it programmatically, don't eyeball it.** Sort operations by delta and keep only those where the rate moved but `count` stayed within ~2× (the guard that separates a real regression from a volume swing); a low-`count` operation has too small a sample for a stable percentile (see disqualifiers). Scope to a few services per run rather than pulling the whole project at once.\n\n### Profile shape\n\n| Pattern                                                  | What it usually means                                         |\n| -------------------------------------------------------- | ------------------------------------------------------------- |\n| `error_count` up, `count` up proportionally (rate ~flat) | traffic spike — **not** a regression, skip                    |\n| `error_count` up, `count` ~flat (error rate steps up)    | real error regression — investigate first                     |\n| `p95` up materially, `count` ~flat                       | latency regression — investigate                              |\n| `p95` up **and** `count` up sharply                      | saturation under load — investigate, lower confidence         |\n| new `(service, name)` erroring, no 7d-ago row            | new code path \u002F recent deploy — investigate                   |\n| service in baseline memory, now ~0 spans                 | traffic cliff (instrumentation break or outage) — investigate |\n\nAlways score the **latest complete** bucket\u002Fwindow — a partial current hour always reads as a drop in volume and a dip in p95.\n\n### Explore\n\nPatterns to watch — starting points, not a checklist.\n\n#### Error-rate regression\n\nFrom the discriminator engine, find operations where error rate stepped up materially while `count` held roughly steady. Confirm _when_ it started: `apm-spans-sparkline` with your service\u002Foperation filters for total counts, then the same call with `statusCodes: [2]` for error counts — error rate per bucket = errors \u002F total; the bucket where the ratio jumps is the onset. Pull a representative failing trace: `query-apm-spans` with a `status_code = 2` filter and `orderBy: \"duration\"`, grab a `trace_id`, then `apm-trace-get` and read `exception.type` \u002F `exception.message` straight off the error span's `attributes` map. Walk `parent_span_id` up to see the request path that led there. **`query-apm-spans` defaults to root spans only** (`rootSpans: true`), so when the regressed operation is a child span (a DB or `Client` call), set `flatSpans: true` (and `rootSpans: false`) or the `status_code = 2` + operation filter matches nothing — the aggregate flags the regression but you can never pull a sample to confirm it.\n\n#### Latency p95 regression\n\nFind operations where `p95_duration_nano` stepped up with steady `count`. Localize the cause: `apm-spans-tree` exposes per-`(parent, child)` edges — read `calls_per_parent_invocation` to separate a child that got slower _per call_ from one that merely runs more times per parent. On a sample slow trace, sort spans by `self_time_nano`: a parent with a large self-time gap is **uninstrumented work**, not a slow child. `apm-spans-duration-histogram` reveals a second hump or fat tail = a distinct slow population worth isolating with a `duration` filter — but it buckets **root-span** duration only (root scoping is unconditional), so reserve it for root-operation latency; for a child-span regression use `apm-spans-tree` and `query-apm-spans` (`flatSpans: true`) instead.\n\nWhen several operations in the same service (or sharing a subsystem — e.g. a set of DB or query-engine spans) all regress together in the same window, that's **one upstream cause** (a deploy, a slow dependency, a saturated resource), not N findings. Recognize the cluster and file a single report naming the shared cause with the operations as evidence, rather than one report per operation.\n\n#### New error signature \u002F failing dependency\n\nAn operation (or a downstream `Client`-kind span calling another service) newly erroring. Scope to the error set (`status_code = 2`) and run `apm-attribute-breakdown` on candidate keys — `server.address`, `http.response.status_code`, `db.system`, `service.version`. Scoped to the error set, the breakdown only describes the **bad** population, so it can't tell a real signature from a value that's simply everywhere: **rerun the same breakdown without the `status_code` filter** and compare shares. A value at ~95% of errors but a small share of total traffic is the signature; one at ~95% of both is just volume. A `service.version` that owns the errors but not the traffic points at a bad deploy.\n\n#### Service traffic cliff\n\nCompare `apm-services-list` and per-service `apm-spans-sparkline` against baseline memory: a service that emitted a steady span volume and dropped to ~0 is an instrumentation break or an outage (the trace-side analog of a capture cliff — spans are not retroactive). Guard against reading a partial current bucket as a cliff: confirm the drop spans ≥2 complete buckets.\n\n### Save memory as you go\n\nWrite a scratchpad entry whenever you observe something a future run should know. Encode the category in the key prefix — `pattern:` \u002F `noise:` \u002F `addressed:` \u002F `dedupe:`. Domain label `apm`.\n\n- key `pattern:apm:baseline-{service}-{operation}` — \"checkout\u002FPOST \u002Forders: p95 ~420ms, error rate ~0.3%, ~1.2k req\u002Fh at this hour-of-week (2026-06-21)\"\n- key `dedupe:apm:{service}:{operation}` — \"Surfaced p95 regression on payments\u002Fcharge (320ms→1.4s, count steady ~800\u002Fh) starting 2026-06-21 14:00 UTC. If still elevated next run, edit the report; if back under ~400ms, treat as recovered.\"\n- key `noise:apm:{service}` — \"frontend\u002FGET \u002Fhealthz: high-volume readiness probe, ignore; deploy-window p95 blips recover within one bucket, don't report unless sustained ≥2 buckets.\"\n- key `report:apm:{service}:{operation}` — the `report_id` of a report you filed for a regression on this operation (error rate, p95, traffic cliff), so the next run edits it (append_note with the fresh window) instead of duplicating.\n- key `reviewer:apm:{service}` — a resolved owner (bare lowercase GitHub login) for a service, so reports route to a human faster.\n\n### Decide\n\nThe generic report mechanics — search the inbox first (via the `report:apm:{service}:{operation}` pointer, else an `inbox-reports-list` search on the specific service \u002F operation, not a broad word like `latency`), edit-vs-author, the status rules, reviewer routing, non-idempotent dedup, and the `priority` \u002F `repository` fields — live in the harness prompt and in `authoring-scouts` → `references\u002Freport-contract.md`. Do not re-derive them here. This section is only the APM judgment layered on top:\n\n- **Edit** when a still-live report already tracks the operation — an error rate still stepped up, a p95 still elevated, a service still dark. A persistent regression is one report across runs: a new complete bucket confirming it's ongoing is a re-escalation (`append_note` the fresh before\u002Fafter numbers), not a fresh report per tick.\n- **Author** when nothing live covers the regression. A report-worthy finding names the concrete `(service, operation)`, gives before\u002Fafter numbers (rate or p95, with the steady denominator), dates the onset bucket, and explains the shape that rules out a volume explanation, with the query results in the `evidence`. These are investigations, not code fixes → `actionability=requires_human_input`. Priority: an active error-rate regression hitting many requests is **P1**; a contained latency regression **P2**; a single-dependency or low-traffic operation **P3**.\n- **Bundle correlated operations into one report.** When a cluster of operations in one service \u002F subsystem regressed together, file one report for the shared cause, not one per operation — an inbox full of six reports for the same slow deploy is noise.\n- **Remember** if real but below the bar, or worth carrying forward (a fresh baseline, a blip to watch), or to record what you ruled out and why.\n- **Skip** with a one-line note if a `noise:` \u002F `addressed:` \u002F `dedupe:` entry, or an existing inbox report, already covers it with no material change.\n\n### Close out\n\nOne paragraph: which services\u002Foperations you scored, which reports you authored or edited, what you remembered (baselines, blips), what you ruled out (volume-tracking spikes, deploy blips, dev services). \"Looked but found nothing meaningful\" is a real outcome. Don't write a separate \"run metadata\" scratchpad entry — this summary already serves that role.\n\n## Disqualifiers (skip these)\n\n- **Raw count tracking traffic.** Error or span count up in lockstep with request `count` (rate ~flat) — volume, not a regression. This is the dominant false positive; check it first.\n- **Deploy-window blips.** A one-bucket p95 or error spike that recovers on its own. Record a `noise:`\u002F`pattern:` entry; report only when sustained across ≥2 complete buckets.\n- **High-but-steady error baselines.** An operation erroring at the same elevated rate in both windows (e.g. ~98% now and ~98% a week ago) is a standing baseline, not a fresh regression — record it once in `pattern:`\u002F`noise:` memory and don't re-report it each run. The signal is the rate _stepping up_, not its absolute level.\n- **Dev \u002F test services.** `service.name` or a resource attribute (`deployment.environment`, env) of `dev` \u002F `local` \u002F `test` \u002F `staging`. Filter before weighing.\n- **Health-check \u002F readiness endpoints.** `\u002Fhealth`, `\u002Fhealthz`, `\u002Fready`, `\u002Flivez` and the like — high volume, low signal. Allowlist them in memory.\n- **Cold-start \u002F low-traffic noise.** A p95 jump on an operation with a tiny `count` (n too small for a stable percentile) is usually a cold start or a single slow trace, not a trend.\n- **Transient client retries.** A `Client` span that errors but whose parent ultimately succeeds (retry succeeded) — don't report unless the failure rate itself is climbing.\n- **Single-trace anomalies.** One slow or error trace with no recurrence across the window.\n- **Known upstream provider \u002F DB errors** already covered by memory — re-report only if the rate or shape changed meaningfully.\n\nWhen in doubt, write memory instead of filing a report.\n\n## MCP tools\n\nDirect (read-only): `apm-services-list`, `apm-spans-aggregate`, `apm-spans-sparkline`, `apm-spans-tree`, `apm-spans-duration-histogram`, `apm-attribute-breakdown`, `apm-attributes-list`, `apm-attribute-values-list`, `apm-spans-count`, `query-apm-spans`, `apm-trace-get`.\n\nInbox & reviewer routing (mechanics in `authoring-scouts` → `references\u002Freport-contract.md`):\n\n- `inbox-reports-list` \u002F `inbox-reports-retrieve` — the reports already in the inbox; check before authoring so you edit instead of duplicating.\n- `inbox-report-artefacts-list` — a comparable report's artefact log; reviewer precedent.\n- `scout-members-list` — the in-run roster for routing `suggested_reviewers` to a service owner.\n\nHarness-level: `scout-project-profile-get`, `scout-scratchpad-search`, `scout-runs-list`, `scout-runs-retrieve`, `scout-emit-report` \u002F `scout-edit-report` (author \u002F edit a report — the report-channel contract is in the harness prompt), `scout-scratchpad-remember`, `scout-scratchpad-forget`. Lean on the bundled `exploring-apm-traces` skill for query shapes, the `kind`\u002F`status_code` enums, and the trace-parsing scripts.\n",{"data":42,"body":50},{"name":4,"description":6,"compatibility":43,"allowed_tools":44,"metadata":47},"PostHog Signals agent (Claude sandbox). Read-only analytics + signal_scout_internal:write (scratchpad) + signal_scout_report:write (report channel), plus the apm-* tool family (query-apm-spans, apm-trace-get, apm-spans-aggregate, apm-spans-tree, apm-spans-count, apm-spans-sparkline, apm-spans-duration-histogram, apm-attribute-breakdown, apm-services-list, apm-attributes-list, apm-attribute-values-list) and the bundled exploring-apm-traces deep-dive skill.\n",[45,46],"emit_report","edit_report",{"owner_team":48,"scope":49},"signals","apm",{"type":51,"children":52},"root",[53,62,68,98,116,155,162,190,222,227,246,265,271,300,307,312,479,485,490,719,781,831,857,863,1036,1048,1054,1059,1066,1222,1228,1336,1348,1354,1438,1444,1463,1469,1506,1578,1584,1641,1765,1771,1776,1782,2001,2006,2012,2086,2104,2153,2231],{"type":54,"tag":55,"props":56,"children":58},"element","h1",{"id":57},"signals-scout-distributed-tracing-apm",[59],{"type":60,"value":61},"text","Signals scout: distributed tracing (APM)",{"type":54,"tag":63,"props":64,"children":65},"p",{},[66],{"type":60,"value":67},"You are a focused APM scout. Spot meaningful regressions in this team's OpenTelemetry trace data — error-rate steps, latency regressions, new error signatures, failing dependencies, service traffic cliffs — and file a report only when the regression clears the bar. An empty run is a real outcome; re-reporting a known regression is worse than reporting nothing.",{"type":54,"tag":63,"props":69,"children":70},{},[71,73,80,82,88,90,96],{"type":60,"value":72},"You author reports directly via the report channel (",{"type":54,"tag":74,"props":75,"children":77},"code",{"className":76},[],[78],{"type":60,"value":79},"scout-emit-report",{"type":60,"value":81}," \u002F ",{"type":54,"tag":74,"props":83,"children":85},{"className":84},[],[86],{"type":60,"value":87},"scout-edit-report",{"type":60,"value":89},"): you've done the investigation, so you own each report 1:1 end-to-end rather than firing weak signals for a pipeline to cluster. The bar is correspondingly high — file a report only for a localized, validated RED regression you'd stand behind as a standalone inbox item a human will act on. A regression that's still moving that the inbox already tracks is an ",{"type":54,"tag":91,"props":92,"children":93},"strong",{},[94],{"type":60,"value":95},"edit",{"type":60,"value":97},", not a new report. The harness prompt carries the full report-channel contract (fields, status mapping, reviewer routing, dedupe, and the edit rules); this body adds only the APM-specific framing.",{"type":54,"tag":63,"props":99,"children":100},{},[101,106,108,114],{"type":54,"tag":91,"props":102,"children":103},{},[104],{"type":60,"value":105},"This is APM \u002F distributed tracing, not AI observability and not logs.",{"type":60,"value":107}," Ignore ",{"type":54,"tag":74,"props":109,"children":111},{"className":110},[],[112],{"type":60,"value":113},"$ai_*",{"type":60,"value":115}," events (the AI-observability scout's territory) and the logs stream (the logs scout's).",{"type":54,"tag":63,"props":117,"children":118},{},[119,132,134,138,140,146,148,153],{"type":54,"tag":91,"props":120,"children":121},{},[122,124,130],{"type":60,"value":123},"The discriminator: a per-(service, operation) RED regression measured as a ",{"type":54,"tag":125,"props":126,"children":127},"em",{},[128],{"type":60,"value":129},"rate",{"type":60,"value":131},", not a raw total, against that operation's own baseline 7 days ago, while request volume holds steady.",{"type":60,"value":133}," Error ",{"type":54,"tag":125,"props":135,"children":136},{},[137],{"type":60,"value":129},{"type":60,"value":139}," (",{"type":54,"tag":74,"props":141,"children":143},{"className":142},[],[144],{"type":60,"value":145},"error_count \u002F count",{"type":60,"value":147},") and p95 ",{"type":54,"tag":125,"props":149,"children":150},{},[151],{"type":60,"value":152},"latency",{"type":60,"value":154}," are the signal; raw error count and raw span count that move in lockstep with traffic are noise. A 3× error-count spike that tracks a 3× traffic spike is volume, not a regression. Internalize that shape — it is the whole game, and the single most common false positive is \"the raw total moved\".",{"type":54,"tag":156,"props":157,"children":159},"h2",{"id":158},"quick-close-out-is-apm-even-in-use",[160],{"type":60,"value":161},"Quick close-out: is APM even in use?",{"type":54,"tag":63,"props":163,"children":164},{},[165,167,172,174,180,182,188],{"type":60,"value":166},"APM spans live in their own span store, ",{"type":54,"tag":91,"props":168,"children":169},{},[170],{"type":60,"value":171},"not",{"type":60,"value":173}," in the analytics event stream — so ",{"type":54,"tag":74,"props":175,"children":177},{"className":176},[],[178],{"type":60,"value":179},"project-profile-get",{"type":60,"value":181},"'s ",{"type":54,"tag":74,"props":183,"children":185},{"className":184},[],[186],{"type":60,"value":187},"top_events",{"type":60,"value":189}," will not list them. Use the APM tools to check:",{"type":54,"tag":191,"props":192,"children":193},"ul",{},[194,211],{"type":54,"tag":195,"props":196,"children":197},"li",{},[198,204,206],{"type":54,"tag":74,"props":199,"children":201},{"className":200},[],[202],{"type":60,"value":203},"apm-services-list",{"type":60,"value":205}," — empty (no service has emitted spans), ",{"type":54,"tag":91,"props":207,"children":208},{},[209],{"type":60,"value":210},"and",{"type":54,"tag":195,"props":212,"children":213},{},[214,220],{"type":54,"tag":74,"props":215,"children":217},{"className":216},[],[218],{"type":60,"value":219},"apm-spans-count",{"type":60,"value":221}," over the last 24h — ~0,",{"type":54,"tag":63,"props":223,"children":224},{},[225],{"type":60,"value":226},"→ this team isn't using distributed tracing. Write one scratchpad entry:",{"type":54,"tag":191,"props":228,"children":229},{},[230,241],{"type":54,"tag":195,"props":231,"children":232},{},[233,235],{"type":60,"value":234},"key: ",{"type":54,"tag":74,"props":236,"children":238},{"className":237},[],[239],{"type":60,"value":240},"not-in-use:apm",{"type":54,"tag":195,"props":242,"children":243},{},[244],{"type":60,"value":245},"content: brief note (\"checked at {timestamp}, apm-services-list empty, 0 spans 24h\")",{"type":54,"tag":63,"props":247,"children":248},{},[249,251,256,258,263],{"type":60,"value":250},"Close out empty. The entry makes future runs cheap, not skipped: a later run still issues the single ",{"type":54,"tag":74,"props":252,"children":254},{"className":253},[],[255],{"type":60,"value":203},{"type":60,"value":257}," (or ",{"type":54,"tag":74,"props":259,"children":261},{"className":260},[],[262],{"type":60,"value":219},{"type":60,"value":264},") call before trusting it — that re-check is the \"short-circuit in seconds\", and it's what catches a team that adopted APM after the entry was written. Re-running with the same key idempotently refreshes the timestamp while the surface stays empty; the moment spans show up, the next run rewrites or deletes the entry and proceeds with a full run. Never close out on the memory alone.",{"type":54,"tag":156,"props":266,"children":268},{"id":267},"how-a-run-works",[269],{"type":60,"value":270},"How a run works",{"type":54,"tag":63,"props":272,"children":273},{},[274,276,282,284,290,292,298],{"type":60,"value":275},"Cycle between these moves; skip what's not useful, revisit what is. Lean on the bundled ",{"type":54,"tag":74,"props":277,"children":279},{"className":278},[],[280],{"type":60,"value":281},"exploring-apm-traces",{"type":60,"value":283}," skill for the actual query shapes, the ",{"type":54,"tag":74,"props":285,"children":287},{"className":286},[],[288],{"type":60,"value":289},"kind",{"type":60,"value":291},"\u002F",{"type":54,"tag":74,"props":293,"children":295},{"className":294},[],[296],{"type":60,"value":297},"status_code",{"type":60,"value":299}," enums, and the trace-parsing scripts — don't re-derive them here.",{"type":54,"tag":301,"props":302,"children":304},"h3",{"id":303},"get-oriented",[305],{"type":60,"value":306},"Get oriented",{"type":54,"tag":63,"props":308,"children":309},{},[310],{"type":60,"value":311},"Three cheap reads cold-start a run:",{"type":54,"tag":191,"props":313,"children":314},{},[315,383,402,412],{"type":54,"tag":195,"props":316,"children":317},{},[318,324,325,331,333],{"type":54,"tag":74,"props":319,"children":321},{"className":320},[],[322],{"type":60,"value":323},"scout-scratchpad-search",{"type":60,"value":139},{"type":54,"tag":74,"props":326,"children":328},{"className":327},[],[329],{"type":60,"value":330},"text=apm",{"type":60,"value":332},") — durable steering from past APM runs. ",{"type":54,"tag":91,"props":334,"children":335},{},[336,338,344,346,352,353,359,360,366,367,373,375,381],{"type":60,"value":337},"Entries with ",{"type":54,"tag":74,"props":339,"children":341},{"className":340},[],[342],{"type":60,"value":343},"pattern:",{"type":60,"value":345},", ",{"type":54,"tag":74,"props":347,"children":349},{"className":348},[],[350],{"type":60,"value":351},"noise:",{"type":60,"value":345},{"type":54,"tag":74,"props":354,"children":356},{"className":355},[],[357],{"type":60,"value":358},"addressed:",{"type":60,"value":345},{"type":54,"tag":74,"props":361,"children":363},{"className":362},[],[364],{"type":60,"value":365},"dedupe:",{"type":60,"value":345},{"type":54,"tag":74,"props":368,"children":370},{"className":369},[],[371],{"type":60,"value":372},"report:",{"type":60,"value":374},", or ",{"type":54,"tag":74,"props":376,"children":378},{"className":377},[],[379],{"type":60,"value":380},"reviewer:",{"type":60,"value":382}," prefixes tell you the per-operation baselines, what's normal, what's already surfaced, what to skip (deploy windows, health-check endpoints, retry-prone dependencies), which report covers a regression, and who owns a service.",{"type":54,"tag":195,"props":384,"children":385},{},[386,392,394,400],{"type":54,"tag":74,"props":387,"children":389},{"className":388},[],[390],{"type":60,"value":391},"scout-runs-list",{"type":60,"value":393}," (last 7d) — what prior APM runs found and ruled out. Skim summaries; pull ",{"type":54,"tag":74,"props":395,"children":397},{"className":396},[],[398],{"type":60,"value":399},"scout-runs-retrieve",{"type":60,"value":401}," only for one worth drilling into.",{"type":54,"tag":195,"props":403,"children":404},{},[405,410],{"type":54,"tag":74,"props":406,"children":408},{"className":407},[],[409],{"type":60,"value":203},{"type":60,"value":411}," — the live service inventory. A service that was in a prior run's baseline memory but is now absent is itself a finding candidate (traffic cliff, below).",{"type":54,"tag":195,"props":413,"children":414},{},[415,421,422,428,429,435,437,443,444,448,450,455,457,463,465,469,471,477],{"type":54,"tag":74,"props":416,"children":418},{"className":417},[],[419],{"type":60,"value":420},"inbox-reports-list",{"type":60,"value":139},{"type":54,"tag":74,"props":423,"children":425},{"className":424},[],[426],{"type":60,"value":427},"ordering=-updated_at",{"type":60,"value":345},{"type":54,"tag":74,"props":430,"children":432},{"className":431},[],[433],{"type":60,"value":434},"search",{"type":60,"value":436},"=the specific service or operation) — the reports already in the inbox. Your own report-channel reports persist their backing signals under ",{"type":54,"tag":74,"props":438,"children":440},{"className":439},[],[441],{"type":60,"value":442},"source_product=signals_scout",{"type":60,"value":139},{"type":54,"tag":91,"props":445,"children":446},{},[447],{"type":60,"value":171},{"type":60,"value":449}," ",{"type":54,"tag":74,"props":451,"children":453},{"className":452},[],[454],{"type":60,"value":49},{"type":60,"value":456},"), so don't filter ",{"type":54,"tag":74,"props":458,"children":460},{"className":459},[],[461],{"type":60,"value":462},"source_product=apm",{"type":60,"value":464}," — you'd miss every report you authored. A regression on an operation you've reported before is an ",{"type":54,"tag":91,"props":466,"children":467},{},[468],{"type":60,"value":95},{"type":60,"value":470},", not a fresh report; pull the closest matches with ",{"type":54,"tag":74,"props":472,"children":474},{"className":473},[],[475],{"type":60,"value":476},"inbox-reports-retrieve",{"type":60,"value":478}," before authoring.",{"type":54,"tag":301,"props":480,"children":482},{"id":481},"the-discriminator-engine",[483],{"type":60,"value":484},"The discriminator engine",{"type":54,"tag":63,"props":486,"children":487},{},[488],{"type":60,"value":489},"One call gives you the seasonality-matched baseline for every operation:",{"type":54,"tag":491,"props":492,"children":497},"pre",{"className":493,"code":494,"language":495,"meta":496,"style":496},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","apm-spans-aggregate\n{\n  \"query\": {\n    \"dateRange\": { \"date_from\": \"-1d\" },\n    \"compareFilter\": { \"compare\": true, \"compare_to\": \"-7d\" }\n  }\n}\n","json","",[498],{"type":54,"tag":74,"props":499,"children":500},{"__ignoreMap":496},[501,513,523,553,619,701,710],{"type":54,"tag":502,"props":503,"children":506},"span",{"class":504,"line":505},"line",1,[507],{"type":54,"tag":502,"props":508,"children":510},{"style":509},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[511],{"type":60,"value":512},"apm-spans-aggregate\n",{"type":54,"tag":502,"props":514,"children":516},{"class":504,"line":515},2,[517],{"type":54,"tag":502,"props":518,"children":520},{"style":519},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[521],{"type":60,"value":522},"{\n",{"type":54,"tag":502,"props":524,"children":526},{"class":504,"line":525},3,[527,532,538,543,548],{"type":54,"tag":502,"props":528,"children":529},{"style":519},[530],{"type":60,"value":531},"  \"",{"type":54,"tag":502,"props":533,"children":535},{"style":534},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[536],{"type":60,"value":537},"query",{"type":54,"tag":502,"props":539,"children":540},{"style":519},[541],{"type":60,"value":542},"\"",{"type":54,"tag":502,"props":544,"children":545},{"style":519},[546],{"type":60,"value":547},":",{"type":54,"tag":502,"props":549,"children":550},{"style":519},[551],{"type":60,"value":552}," {\n",{"type":54,"tag":502,"props":554,"children":556},{"class":504,"line":555},4,[557,562,568,572,576,581,586,592,596,600,604,610,614],{"type":54,"tag":502,"props":558,"children":559},{"style":519},[560],{"type":60,"value":561},"    \"",{"type":54,"tag":502,"props":563,"children":565},{"style":564},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[566],{"type":60,"value":567},"dateRange",{"type":54,"tag":502,"props":569,"children":570},{"style":519},[571],{"type":60,"value":542},{"type":54,"tag":502,"props":573,"children":574},{"style":519},[575],{"type":60,"value":547},{"type":54,"tag":502,"props":577,"children":578},{"style":519},[579],{"type":60,"value":580}," {",{"type":54,"tag":502,"props":582,"children":583},{"style":519},[584],{"type":60,"value":585}," \"",{"type":54,"tag":502,"props":587,"children":589},{"style":588},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[590],{"type":60,"value":591},"date_from",{"type":54,"tag":502,"props":593,"children":594},{"style":519},[595],{"type":60,"value":542},{"type":54,"tag":502,"props":597,"children":598},{"style":519},[599],{"type":60,"value":547},{"type":54,"tag":502,"props":601,"children":602},{"style":519},[603],{"type":60,"value":585},{"type":54,"tag":502,"props":605,"children":607},{"style":606},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[608],{"type":60,"value":609},"-1d",{"type":54,"tag":502,"props":611,"children":612},{"style":519},[613],{"type":60,"value":542},{"type":54,"tag":502,"props":615,"children":616},{"style":519},[617],{"type":60,"value":618}," },\n",{"type":54,"tag":502,"props":620,"children":622},{"class":504,"line":621},5,[623,627,632,636,640,644,648,653,657,661,666,670,675,679,683,687,692,696],{"type":54,"tag":502,"props":624,"children":625},{"style":519},[626],{"type":60,"value":561},{"type":54,"tag":502,"props":628,"children":629},{"style":564},[630],{"type":60,"value":631},"compareFilter",{"type":54,"tag":502,"props":633,"children":634},{"style":519},[635],{"type":60,"value":542},{"type":54,"tag":502,"props":637,"children":638},{"style":519},[639],{"type":60,"value":547},{"type":54,"tag":502,"props":641,"children":642},{"style":519},[643],{"type":60,"value":580},{"type":54,"tag":502,"props":645,"children":646},{"style":519},[647],{"type":60,"value":585},{"type":54,"tag":502,"props":649,"children":650},{"style":588},[651],{"type":60,"value":652},"compare",{"type":54,"tag":502,"props":654,"children":655},{"style":519},[656],{"type":60,"value":542},{"type":54,"tag":502,"props":658,"children":659},{"style":519},[660],{"type":60,"value":547},{"type":54,"tag":502,"props":662,"children":663},{"style":519},[664],{"type":60,"value":665}," true,",{"type":54,"tag":502,"props":667,"children":668},{"style":519},[669],{"type":60,"value":585},{"type":54,"tag":502,"props":671,"children":672},{"style":588},[673],{"type":60,"value":674},"compare_to",{"type":54,"tag":502,"props":676,"children":677},{"style":519},[678],{"type":60,"value":542},{"type":54,"tag":502,"props":680,"children":681},{"style":519},[682],{"type":60,"value":547},{"type":54,"tag":502,"props":684,"children":685},{"style":519},[686],{"type":60,"value":585},{"type":54,"tag":502,"props":688,"children":689},{"style":606},[690],{"type":60,"value":691},"-7d",{"type":54,"tag":502,"props":693,"children":694},{"style":519},[695],{"type":60,"value":542},{"type":54,"tag":502,"props":697,"children":698},{"style":519},[699],{"type":60,"value":700}," }\n",{"type":54,"tag":502,"props":702,"children":704},{"class":504,"line":703},6,[705],{"type":54,"tag":502,"props":706,"children":707},{"style":519},[708],{"type":60,"value":709},"  }\n",{"type":54,"tag":502,"props":711,"children":713},{"class":504,"line":712},7,[714],{"type":54,"tag":502,"props":715,"children":716},{"style":519},[717],{"type":60,"value":718},"}\n",{"type":54,"tag":63,"props":720,"children":721},{},[722,728,730,735,737,743,745,751,752,758,759,765,766,772,774,779],{"type":54,"tag":74,"props":723,"children":725},{"className":724},[],[726],{"type":60,"value":727},"results",{"type":60,"value":729}," is the last 24h, ",{"type":54,"tag":74,"props":731,"children":733},{"className":732},[],[734],{"type":60,"value":652},{"type":60,"value":736}," is the same 24h one week ago — both as one row per ",{"type":54,"tag":74,"props":738,"children":740},{"className":739},[],[741],{"type":60,"value":742},"(service_name, name)",{"type":60,"value":744}," with ",{"type":54,"tag":74,"props":746,"children":748},{"className":747},[],[749],{"type":60,"value":750},"count",{"type":60,"value":345},{"type":54,"tag":74,"props":753,"children":755},{"className":754},[],[756],{"type":60,"value":757},"error_count",{"type":60,"value":345},{"type":54,"tag":74,"props":760,"children":762},{"className":761},[],[763],{"type":60,"value":764},"p50_duration_nano",{"type":60,"value":345},{"type":54,"tag":74,"props":767,"children":769},{"className":768},[],[770],{"type":60,"value":771},"p95_duration_nano",{"type":60,"value":773},". Join the two arrays on ",{"type":54,"tag":74,"props":775,"children":777},{"className":776},[],[778],{"type":60,"value":742},{"type":60,"value":780}," and compute, per operation:",{"type":54,"tag":191,"props":782,"children":783},{},[784,800,815],{"type":54,"tag":195,"props":785,"children":786},{},[787,792,793,798],{"type":54,"tag":91,"props":788,"children":789},{},[790],{"type":60,"value":791},"error rate",{"type":60,"value":449},{"type":54,"tag":74,"props":794,"children":796},{"className":795},[],[797],{"type":60,"value":145},{"type":60,"value":799},", now vs 7d-ago",{"type":54,"tag":195,"props":801,"children":802},{},[803,808,809,814],{"type":54,"tag":91,"props":804,"children":805},{},[806],{"type":60,"value":807},"p95 latency",{"type":60,"value":449},{"type":54,"tag":74,"props":810,"children":812},{"className":811},[],[813],{"type":60,"value":771},{"type":60,"value":799},{"type":54,"tag":195,"props":816,"children":817},{},[818,823,824,829],{"type":54,"tag":91,"props":819,"children":820},{},[821],{"type":60,"value":822},"request volume",{"type":60,"value":449},{"type":54,"tag":74,"props":825,"children":827},{"className":826},[],[828],{"type":60,"value":750},{"type":60,"value":830},", now vs 7d-ago (the denominator guard)",{"type":54,"tag":63,"props":832,"children":833},{},[834,836,841,843,848,850,855],{"type":60,"value":835},"A busy service returns hundreds of operations (the payload runs to 100KB+ and the harness persists it to a file) — ",{"type":54,"tag":91,"props":837,"children":838},{},[839],{"type":60,"value":840},"process it programmatically, don't eyeball it.",{"type":60,"value":842}," Sort operations by delta and keep only those where the rate moved but ",{"type":54,"tag":74,"props":844,"children":846},{"className":845},[],[847],{"type":60,"value":750},{"type":60,"value":849}," stayed within ~2× (the guard that separates a real regression from a volume swing); a low-",{"type":54,"tag":74,"props":851,"children":853},{"className":852},[],[854],{"type":60,"value":750},{"type":60,"value":856}," operation has too small a sample for a stable percentile (see disqualifiers). Scope to a few services per run rather than pulling the whole project at once.",{"type":54,"tag":301,"props":858,"children":860},{"id":859},"profile-shape",[861],{"type":60,"value":862},"Profile shape",{"type":54,"tag":864,"props":865,"children":866},"table",{},[867,886],{"type":54,"tag":868,"props":869,"children":870},"thead",{},[871],{"type":54,"tag":872,"props":873,"children":874},"tr",{},[875,881],{"type":54,"tag":876,"props":877,"children":878},"th",{},[879],{"type":60,"value":880},"Pattern",{"type":54,"tag":876,"props":882,"children":883},{},[884],{"type":60,"value":885},"What it usually means",{"type":54,"tag":887,"props":888,"children":889},"tbody",{},[890,922,946,972,1002,1023],{"type":54,"tag":872,"props":891,"children":892},{},[893,911],{"type":54,"tag":894,"props":895,"children":896},"td",{},[897,902,904,909],{"type":54,"tag":74,"props":898,"children":900},{"className":899},[],[901],{"type":60,"value":757},{"type":60,"value":903}," up, ",{"type":54,"tag":74,"props":905,"children":907},{"className":906},[],[908],{"type":60,"value":750},{"type":60,"value":910}," up proportionally (rate ~flat)",{"type":54,"tag":894,"props":912,"children":913},{},[914,916,920],{"type":60,"value":915},"traffic spike — ",{"type":54,"tag":91,"props":917,"children":918},{},[919],{"type":60,"value":171},{"type":60,"value":921}," a regression, skip",{"type":54,"tag":872,"props":923,"children":924},{},[925,941],{"type":54,"tag":894,"props":926,"children":927},{},[928,933,934,939],{"type":54,"tag":74,"props":929,"children":931},{"className":930},[],[932],{"type":60,"value":757},{"type":60,"value":903},{"type":54,"tag":74,"props":935,"children":937},{"className":936},[],[938],{"type":60,"value":750},{"type":60,"value":940}," ~flat (error rate steps up)",{"type":54,"tag":894,"props":942,"children":943},{},[944],{"type":60,"value":945},"real error regression — investigate first",{"type":54,"tag":872,"props":947,"children":948},{},[949,967],{"type":54,"tag":894,"props":950,"children":951},{},[952,958,960,965],{"type":54,"tag":74,"props":953,"children":955},{"className":954},[],[956],{"type":60,"value":957},"p95",{"type":60,"value":959}," up materially, ",{"type":54,"tag":74,"props":961,"children":963},{"className":962},[],[964],{"type":60,"value":750},{"type":60,"value":966}," ~flat",{"type":54,"tag":894,"props":968,"children":969},{},[970],{"type":60,"value":971},"latency regression — investigate",{"type":54,"tag":872,"props":973,"children":974},{},[975,997],{"type":54,"tag":894,"props":976,"children":977},{},[978,983,985,989,990,995],{"type":54,"tag":74,"props":979,"children":981},{"className":980},[],[982],{"type":60,"value":957},{"type":60,"value":984}," up ",{"type":54,"tag":91,"props":986,"children":987},{},[988],{"type":60,"value":210},{"type":60,"value":449},{"type":54,"tag":74,"props":991,"children":993},{"className":992},[],[994],{"type":60,"value":750},{"type":60,"value":996}," up sharply",{"type":54,"tag":894,"props":998,"children":999},{},[1000],{"type":60,"value":1001},"saturation under load — investigate, lower confidence",{"type":54,"tag":872,"props":1003,"children":1004},{},[1005,1018],{"type":54,"tag":894,"props":1006,"children":1007},{},[1008,1010,1016],{"type":60,"value":1009},"new ",{"type":54,"tag":74,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":60,"value":1015},"(service, name)",{"type":60,"value":1017}," erroring, no 7d-ago row",{"type":54,"tag":894,"props":1019,"children":1020},{},[1021],{"type":60,"value":1022},"new code path \u002F recent deploy — investigate",{"type":54,"tag":872,"props":1024,"children":1025},{},[1026,1031],{"type":54,"tag":894,"props":1027,"children":1028},{},[1029],{"type":60,"value":1030},"service in baseline memory, now ~0 spans",{"type":54,"tag":894,"props":1032,"children":1033},{},[1034],{"type":60,"value":1035},"traffic cliff (instrumentation break or outage) — investigate",{"type":54,"tag":63,"props":1037,"children":1038},{},[1039,1041,1046],{"type":60,"value":1040},"Always score the ",{"type":54,"tag":91,"props":1042,"children":1043},{},[1044],{"type":60,"value":1045},"latest complete",{"type":60,"value":1047}," bucket\u002Fwindow — a partial current hour always reads as a drop in volume and a dip in p95.",{"type":54,"tag":301,"props":1049,"children":1051},{"id":1050},"explore",[1052],{"type":60,"value":1053},"Explore",{"type":54,"tag":63,"props":1055,"children":1056},{},[1057],{"type":60,"value":1058},"Patterns to watch — starting points, not a checklist.",{"type":54,"tag":1060,"props":1061,"children":1063},"h4",{"id":1062},"error-rate-regression",[1064],{"type":60,"value":1065},"Error-rate regression",{"type":54,"tag":63,"props":1067,"children":1068},{},[1069,1071,1076,1078,1083,1085,1091,1093,1099,1101,1107,1109,1115,1117,1123,1125,1131,1133,1139,1141,1147,1148,1154,1156,1162,1164,1170,1172,1182,1183,1189,1191,1197,1199,1205,1207,1213,1215,1220],{"type":60,"value":1070},"From the discriminator engine, find operations where error rate stepped up materially while ",{"type":54,"tag":74,"props":1072,"children":1074},{"className":1073},[],[1075],{"type":60,"value":750},{"type":60,"value":1077}," held roughly steady. Confirm ",{"type":54,"tag":125,"props":1079,"children":1080},{},[1081],{"type":60,"value":1082},"when",{"type":60,"value":1084}," it started: ",{"type":54,"tag":74,"props":1086,"children":1088},{"className":1087},[],[1089],{"type":60,"value":1090},"apm-spans-sparkline",{"type":60,"value":1092}," with your service\u002Foperation filters for total counts, then the same call with ",{"type":54,"tag":74,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":60,"value":1098},"statusCodes: [2]",{"type":60,"value":1100}," for error counts — error rate per bucket = errors \u002F total; the bucket where the ratio jumps is the onset. Pull a representative failing trace: ",{"type":54,"tag":74,"props":1102,"children":1104},{"className":1103},[],[1105],{"type":60,"value":1106},"query-apm-spans",{"type":60,"value":1108}," with a ",{"type":54,"tag":74,"props":1110,"children":1112},{"className":1111},[],[1113],{"type":60,"value":1114},"status_code = 2",{"type":60,"value":1116}," filter and ",{"type":54,"tag":74,"props":1118,"children":1120},{"className":1119},[],[1121],{"type":60,"value":1122},"orderBy: \"duration\"",{"type":60,"value":1124},", grab a ",{"type":54,"tag":74,"props":1126,"children":1128},{"className":1127},[],[1129],{"type":60,"value":1130},"trace_id",{"type":60,"value":1132},", then ",{"type":54,"tag":74,"props":1134,"children":1136},{"className":1135},[],[1137],{"type":60,"value":1138},"apm-trace-get",{"type":60,"value":1140}," and read ",{"type":54,"tag":74,"props":1142,"children":1144},{"className":1143},[],[1145],{"type":60,"value":1146},"exception.type",{"type":60,"value":81},{"type":54,"tag":74,"props":1149,"children":1151},{"className":1150},[],[1152],{"type":60,"value":1153},"exception.message",{"type":60,"value":1155}," straight off the error span's ",{"type":54,"tag":74,"props":1157,"children":1159},{"className":1158},[],[1160],{"type":60,"value":1161},"attributes",{"type":60,"value":1163}," map. Walk ",{"type":54,"tag":74,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":60,"value":1169},"parent_span_id",{"type":60,"value":1171}," up to see the request path that led there. ",{"type":54,"tag":91,"props":1173,"children":1174},{},[1175,1180],{"type":54,"tag":74,"props":1176,"children":1178},{"className":1177},[],[1179],{"type":60,"value":1106},{"type":60,"value":1181}," defaults to root spans only",{"type":60,"value":139},{"type":54,"tag":74,"props":1184,"children":1186},{"className":1185},[],[1187],{"type":60,"value":1188},"rootSpans: true",{"type":60,"value":1190},"), so when the regressed operation is a child span (a DB or ",{"type":54,"tag":74,"props":1192,"children":1194},{"className":1193},[],[1195],{"type":60,"value":1196},"Client",{"type":60,"value":1198}," call), set ",{"type":54,"tag":74,"props":1200,"children":1202},{"className":1201},[],[1203],{"type":60,"value":1204},"flatSpans: true",{"type":60,"value":1206}," (and ",{"type":54,"tag":74,"props":1208,"children":1210},{"className":1209},[],[1211],{"type":60,"value":1212},"rootSpans: false",{"type":60,"value":1214},") or the ",{"type":54,"tag":74,"props":1216,"children":1218},{"className":1217},[],[1219],{"type":60,"value":1114},{"type":60,"value":1221}," + operation filter matches nothing — the aggregate flags the regression but you can never pull a sample to confirm it.",{"type":54,"tag":1060,"props":1223,"children":1225},{"id":1224},"latency-p95-regression",[1226],{"type":60,"value":1227},"Latency p95 regression",{"type":54,"tag":63,"props":1229,"children":1230},{},[1231,1233,1238,1240,1245,1247,1253,1255,1261,1263,1269,1271,1276,1278,1284,1286,1291,1293,1299,1301,1307,1309,1314,1316,1321,1323,1328,1329,1334],{"type":60,"value":1232},"Find operations where ",{"type":54,"tag":74,"props":1234,"children":1236},{"className":1235},[],[1237],{"type":60,"value":771},{"type":60,"value":1239}," stepped up with steady ",{"type":54,"tag":74,"props":1241,"children":1243},{"className":1242},[],[1244],{"type":60,"value":750},{"type":60,"value":1246},". Localize the cause: ",{"type":54,"tag":74,"props":1248,"children":1250},{"className":1249},[],[1251],{"type":60,"value":1252},"apm-spans-tree",{"type":60,"value":1254}," exposes per-",{"type":54,"tag":74,"props":1256,"children":1258},{"className":1257},[],[1259],{"type":60,"value":1260},"(parent, child)",{"type":60,"value":1262}," edges — read ",{"type":54,"tag":74,"props":1264,"children":1266},{"className":1265},[],[1267],{"type":60,"value":1268},"calls_per_parent_invocation",{"type":60,"value":1270}," to separate a child that got slower ",{"type":54,"tag":125,"props":1272,"children":1273},{},[1274],{"type":60,"value":1275},"per call",{"type":60,"value":1277}," from one that merely runs more times per parent. On a sample slow trace, sort spans by ",{"type":54,"tag":74,"props":1279,"children":1281},{"className":1280},[],[1282],{"type":60,"value":1283},"self_time_nano",{"type":60,"value":1285},": a parent with a large self-time gap is ",{"type":54,"tag":91,"props":1287,"children":1288},{},[1289],{"type":60,"value":1290},"uninstrumented work",{"type":60,"value":1292},", not a slow child. ",{"type":54,"tag":74,"props":1294,"children":1296},{"className":1295},[],[1297],{"type":60,"value":1298},"apm-spans-duration-histogram",{"type":60,"value":1300}," reveals a second hump or fat tail = a distinct slow population worth isolating with a ",{"type":54,"tag":74,"props":1302,"children":1304},{"className":1303},[],[1305],{"type":60,"value":1306},"duration",{"type":60,"value":1308}," filter — but it buckets ",{"type":54,"tag":91,"props":1310,"children":1311},{},[1312],{"type":60,"value":1313},"root-span",{"type":60,"value":1315}," duration only (root scoping is unconditional), so reserve it for root-operation latency; for a child-span regression use ",{"type":54,"tag":74,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":60,"value":1252},{"type":60,"value":1322}," and ",{"type":54,"tag":74,"props":1324,"children":1326},{"className":1325},[],[1327],{"type":60,"value":1106},{"type":60,"value":139},{"type":54,"tag":74,"props":1330,"children":1332},{"className":1331},[],[1333],{"type":60,"value":1204},{"type":60,"value":1335},") instead.",{"type":54,"tag":63,"props":1337,"children":1338},{},[1339,1341,1346],{"type":60,"value":1340},"When several operations in the same service (or sharing a subsystem — e.g. a set of DB or query-engine spans) all regress together in the same window, that's ",{"type":54,"tag":91,"props":1342,"children":1343},{},[1344],{"type":60,"value":1345},"one upstream cause",{"type":60,"value":1347}," (a deploy, a slow dependency, a saturated resource), not N findings. Recognize the cluster and file a single report naming the shared cause with the operations as evidence, rather than one report per operation.",{"type":54,"tag":1060,"props":1349,"children":1351},{"id":1350},"new-error-signature-failing-dependency",[1352],{"type":60,"value":1353},"New error signature \u002F failing dependency",{"type":54,"tag":63,"props":1355,"children":1356},{},[1357,1359,1364,1366,1371,1373,1379,1381,1387,1388,1394,1395,1401,1402,1408,1410,1415,1417,1429,1431,1436],{"type":60,"value":1358},"An operation (or a downstream ",{"type":54,"tag":74,"props":1360,"children":1362},{"className":1361},[],[1363],{"type":60,"value":1196},{"type":60,"value":1365},"-kind span calling another service) newly erroring. Scope to the error set (",{"type":54,"tag":74,"props":1367,"children":1369},{"className":1368},[],[1370],{"type":60,"value":1114},{"type":60,"value":1372},") and run ",{"type":54,"tag":74,"props":1374,"children":1376},{"className":1375},[],[1377],{"type":60,"value":1378},"apm-attribute-breakdown",{"type":60,"value":1380}," on candidate keys — ",{"type":54,"tag":74,"props":1382,"children":1384},{"className":1383},[],[1385],{"type":60,"value":1386},"server.address",{"type":60,"value":345},{"type":54,"tag":74,"props":1389,"children":1391},{"className":1390},[],[1392],{"type":60,"value":1393},"http.response.status_code",{"type":60,"value":345},{"type":54,"tag":74,"props":1396,"children":1398},{"className":1397},[],[1399],{"type":60,"value":1400},"db.system",{"type":60,"value":345},{"type":54,"tag":74,"props":1403,"children":1405},{"className":1404},[],[1406],{"type":60,"value":1407},"service.version",{"type":60,"value":1409},". Scoped to the error set, the breakdown only describes the ",{"type":54,"tag":91,"props":1411,"children":1412},{},[1413],{"type":60,"value":1414},"bad",{"type":60,"value":1416}," population, so it can't tell a real signature from a value that's simply everywhere: ",{"type":54,"tag":91,"props":1418,"children":1419},{},[1420,1422,1427],{"type":60,"value":1421},"rerun the same breakdown without the ",{"type":54,"tag":74,"props":1423,"children":1425},{"className":1424},[],[1426],{"type":60,"value":297},{"type":60,"value":1428}," filter",{"type":60,"value":1430}," and compare shares. A value at ~95% of errors but a small share of total traffic is the signature; one at ~95% of both is just volume. A ",{"type":54,"tag":74,"props":1432,"children":1434},{"className":1433},[],[1435],{"type":60,"value":1407},{"type":60,"value":1437}," that owns the errors but not the traffic points at a bad deploy.",{"type":54,"tag":1060,"props":1439,"children":1441},{"id":1440},"service-traffic-cliff",[1442],{"type":60,"value":1443},"Service traffic cliff",{"type":54,"tag":63,"props":1445,"children":1446},{},[1447,1449,1454,1456,1461],{"type":60,"value":1448},"Compare ",{"type":54,"tag":74,"props":1450,"children":1452},{"className":1451},[],[1453],{"type":60,"value":203},{"type":60,"value":1455}," and per-service ",{"type":54,"tag":74,"props":1457,"children":1459},{"className":1458},[],[1460],{"type":60,"value":1090},{"type":60,"value":1462}," against baseline memory: a service that emitted a steady span volume and dropped to ~0 is an instrumentation break or an outage (the trace-side analog of a capture cliff — spans are not retroactive). Guard against reading a partial current bucket as a cliff: confirm the drop spans ≥2 complete buckets.",{"type":54,"tag":301,"props":1464,"children":1466},{"id":1465},"save-memory-as-you-go",[1467],{"type":60,"value":1468},"Save memory as you go",{"type":54,"tag":63,"props":1470,"children":1471},{},[1472,1474,1479,1480,1485,1486,1491,1492,1497,1499,1504],{"type":60,"value":1473},"Write a scratchpad entry whenever you observe something a future run should know. Encode the category in the key prefix — ",{"type":54,"tag":74,"props":1475,"children":1477},{"className":1476},[],[1478],{"type":60,"value":343},{"type":60,"value":81},{"type":54,"tag":74,"props":1481,"children":1483},{"className":1482},[],[1484],{"type":60,"value":351},{"type":60,"value":81},{"type":54,"tag":74,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":60,"value":358},{"type":60,"value":81},{"type":54,"tag":74,"props":1493,"children":1495},{"className":1494},[],[1496],{"type":60,"value":365},{"type":60,"value":1498},". Domain label ",{"type":54,"tag":74,"props":1500,"children":1502},{"className":1501},[],[1503],{"type":60,"value":49},{"type":60,"value":1505},".",{"type":54,"tag":191,"props":1507,"children":1508},{},[1509,1522,1534,1546,1566],{"type":54,"tag":195,"props":1510,"children":1511},{},[1512,1514,1520],{"type":60,"value":1513},"key ",{"type":54,"tag":74,"props":1515,"children":1517},{"className":1516},[],[1518],{"type":60,"value":1519},"pattern:apm:baseline-{service}-{operation}",{"type":60,"value":1521}," — \"checkout\u002FPOST \u002Forders: p95 ~420ms, error rate ~0.3%, ~1.2k req\u002Fh at this hour-of-week (2026-06-21)\"",{"type":54,"tag":195,"props":1523,"children":1524},{},[1525,1526,1532],{"type":60,"value":1513},{"type":54,"tag":74,"props":1527,"children":1529},{"className":1528},[],[1530],{"type":60,"value":1531},"dedupe:apm:{service}:{operation}",{"type":60,"value":1533}," — \"Surfaced p95 regression on payments\u002Fcharge (320ms→1.4s, count steady ~800\u002Fh) starting 2026-06-21 14:00 UTC. If still elevated next run, edit the report; if back under ~400ms, treat as recovered.\"",{"type":54,"tag":195,"props":1535,"children":1536},{},[1537,1538,1544],{"type":60,"value":1513},{"type":54,"tag":74,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":60,"value":1543},"noise:apm:{service}",{"type":60,"value":1545}," — \"frontend\u002FGET \u002Fhealthz: high-volume readiness probe, ignore; deploy-window p95 blips recover within one bucket, don't report unless sustained ≥2 buckets.\"",{"type":54,"tag":195,"props":1547,"children":1548},{},[1549,1550,1556,1558,1564],{"type":60,"value":1513},{"type":54,"tag":74,"props":1551,"children":1553},{"className":1552},[],[1554],{"type":60,"value":1555},"report:apm:{service}:{operation}",{"type":60,"value":1557}," — the ",{"type":54,"tag":74,"props":1559,"children":1561},{"className":1560},[],[1562],{"type":60,"value":1563},"report_id",{"type":60,"value":1565}," of a report you filed for a regression on this operation (error rate, p95, traffic cliff), so the next run edits it (append_note with the fresh window) instead of duplicating.",{"type":54,"tag":195,"props":1567,"children":1568},{},[1569,1570,1576],{"type":60,"value":1513},{"type":54,"tag":74,"props":1571,"children":1573},{"className":1572},[],[1574],{"type":60,"value":1575},"reviewer:apm:{service}",{"type":60,"value":1577}," — a resolved owner (bare lowercase GitHub login) for a service, so reports route to a human faster.",{"type":54,"tag":301,"props":1579,"children":1581},{"id":1580},"decide",[1582],{"type":60,"value":1583},"Decide",{"type":54,"tag":63,"props":1585,"children":1586},{},[1587,1589,1594,1596,1601,1603,1608,1610,1616,1617,1623,1625,1631,1633,1639],{"type":60,"value":1588},"The generic report mechanics — search the inbox first (via the ",{"type":54,"tag":74,"props":1590,"children":1592},{"className":1591},[],[1593],{"type":60,"value":1555},{"type":60,"value":1595}," pointer, else an ",{"type":54,"tag":74,"props":1597,"children":1599},{"className":1598},[],[1600],{"type":60,"value":420},{"type":60,"value":1602}," search on the specific service \u002F operation, not a broad word like ",{"type":54,"tag":74,"props":1604,"children":1606},{"className":1605},[],[1607],{"type":60,"value":152},{"type":60,"value":1609},"), edit-vs-author, the status rules, reviewer routing, non-idempotent dedup, and the ",{"type":54,"tag":74,"props":1611,"children":1613},{"className":1612},[],[1614],{"type":60,"value":1615},"priority",{"type":60,"value":81},{"type":54,"tag":74,"props":1618,"children":1620},{"className":1619},[],[1621],{"type":60,"value":1622},"repository",{"type":60,"value":1624}," fields — live in the harness prompt and in ",{"type":54,"tag":74,"props":1626,"children":1628},{"className":1627},[],[1629],{"type":60,"value":1630},"authoring-scouts",{"type":60,"value":1632}," → ",{"type":54,"tag":74,"props":1634,"children":1636},{"className":1635},[],[1637],{"type":60,"value":1638},"references\u002Freport-contract.md",{"type":60,"value":1640},". Do not re-derive them here. This section is only the APM judgment layered on top:",{"type":54,"tag":191,"props":1642,"children":1643},{},[1644,1662,1716,1726,1736],{"type":54,"tag":195,"props":1645,"children":1646},{},[1647,1652,1654,1660],{"type":54,"tag":91,"props":1648,"children":1649},{},[1650],{"type":60,"value":1651},"Edit",{"type":60,"value":1653}," when a still-live report already tracks the operation — an error rate still stepped up, a p95 still elevated, a service still dark. A persistent regression is one report across runs: a new complete bucket confirming it's ongoing is a re-escalation (",{"type":54,"tag":74,"props":1655,"children":1657},{"className":1656},[],[1658],{"type":60,"value":1659},"append_note",{"type":60,"value":1661}," the fresh before\u002Fafter numbers), not a fresh report per tick.",{"type":54,"tag":195,"props":1663,"children":1664},{},[1665,1670,1672,1678,1680,1686,1688,1694,1696,1701,1703,1708,1710,1715],{"type":54,"tag":91,"props":1666,"children":1667},{},[1668],{"type":60,"value":1669},"Author",{"type":60,"value":1671}," when nothing live covers the regression. A report-worthy finding names the concrete ",{"type":54,"tag":74,"props":1673,"children":1675},{"className":1674},[],[1676],{"type":60,"value":1677},"(service, operation)",{"type":60,"value":1679},", gives before\u002Fafter numbers (rate or p95, with the steady denominator), dates the onset bucket, and explains the shape that rules out a volume explanation, with the query results in the ",{"type":54,"tag":74,"props":1681,"children":1683},{"className":1682},[],[1684],{"type":60,"value":1685},"evidence",{"type":60,"value":1687},". These are investigations, not code fixes → ",{"type":54,"tag":74,"props":1689,"children":1691},{"className":1690},[],[1692],{"type":60,"value":1693},"actionability=requires_human_input",{"type":60,"value":1695},". Priority: an active error-rate regression hitting many requests is ",{"type":54,"tag":91,"props":1697,"children":1698},{},[1699],{"type":60,"value":1700},"P1",{"type":60,"value":1702},"; a contained latency regression ",{"type":54,"tag":91,"props":1704,"children":1705},{},[1706],{"type":60,"value":1707},"P2",{"type":60,"value":1709},"; a single-dependency or low-traffic operation ",{"type":54,"tag":91,"props":1711,"children":1712},{},[1713],{"type":60,"value":1714},"P3",{"type":60,"value":1505},{"type":54,"tag":195,"props":1717,"children":1718},{},[1719,1724],{"type":54,"tag":91,"props":1720,"children":1721},{},[1722],{"type":60,"value":1723},"Bundle correlated operations into one report.",{"type":60,"value":1725}," When a cluster of operations in one service \u002F subsystem regressed together, file one report for the shared cause, not one per operation — an inbox full of six reports for the same slow deploy is noise.",{"type":54,"tag":195,"props":1727,"children":1728},{},[1729,1734],{"type":54,"tag":91,"props":1730,"children":1731},{},[1732],{"type":60,"value":1733},"Remember",{"type":60,"value":1735}," if real but below the bar, or worth carrying forward (a fresh baseline, a blip to watch), or to record what you ruled out and why.",{"type":54,"tag":195,"props":1737,"children":1738},{},[1739,1744,1746,1751,1752,1757,1758,1763],{"type":54,"tag":91,"props":1740,"children":1741},{},[1742],{"type":60,"value":1743},"Skip",{"type":60,"value":1745}," with a one-line note if a ",{"type":54,"tag":74,"props":1747,"children":1749},{"className":1748},[],[1750],{"type":60,"value":351},{"type":60,"value":81},{"type":54,"tag":74,"props":1753,"children":1755},{"className":1754},[],[1756],{"type":60,"value":358},{"type":60,"value":81},{"type":54,"tag":74,"props":1759,"children":1761},{"className":1760},[],[1762],{"type":60,"value":365},{"type":60,"value":1764}," entry, or an existing inbox report, already covers it with no material change.",{"type":54,"tag":301,"props":1766,"children":1768},{"id":1767},"close-out",[1769],{"type":60,"value":1770},"Close out",{"type":54,"tag":63,"props":1772,"children":1773},{},[1774],{"type":60,"value":1775},"One paragraph: which services\u002Foperations you scored, which reports you authored or edited, what you remembered (baselines, blips), what you ruled out (volume-tracking spikes, deploy blips, dev services). \"Looked but found nothing meaningful\" is a real outcome. Don't write a separate \"run metadata\" scratchpad entry — this summary already serves that role.",{"type":54,"tag":156,"props":1777,"children":1779},{"id":1778},"disqualifiers-skip-these",[1780],{"type":60,"value":1781},"Disqualifiers (skip these)",{"type":54,"tag":191,"props":1783,"children":1784},{},[1785,1802,1825,1855,1909,1947,1964,1981,1991],{"type":54,"tag":195,"props":1786,"children":1787},{},[1788,1793,1795,1800],{"type":54,"tag":91,"props":1789,"children":1790},{},[1791],{"type":60,"value":1792},"Raw count tracking traffic.",{"type":60,"value":1794}," Error or span count up in lockstep with request ",{"type":54,"tag":74,"props":1796,"children":1798},{"className":1797},[],[1799],{"type":60,"value":750},{"type":60,"value":1801}," (rate ~flat) — volume, not a regression. This is the dominant false positive; check it first.",{"type":54,"tag":195,"props":1803,"children":1804},{},[1805,1810,1812,1817,1818,1823],{"type":54,"tag":91,"props":1806,"children":1807},{},[1808],{"type":60,"value":1809},"Deploy-window blips.",{"type":60,"value":1811}," A one-bucket p95 or error spike that recovers on its own. Record a ",{"type":54,"tag":74,"props":1813,"children":1815},{"className":1814},[],[1816],{"type":60,"value":351},{"type":60,"value":291},{"type":54,"tag":74,"props":1819,"children":1821},{"className":1820},[],[1822],{"type":60,"value":343},{"type":60,"value":1824}," entry; report only when sustained across ≥2 complete buckets.",{"type":54,"tag":195,"props":1826,"children":1827},{},[1828,1833,1835,1840,1841,1846,1848,1853],{"type":54,"tag":91,"props":1829,"children":1830},{},[1831],{"type":60,"value":1832},"High-but-steady error baselines.",{"type":60,"value":1834}," An operation erroring at the same elevated rate in both windows (e.g. ~98% now and ~98% a week ago) is a standing baseline, not a fresh regression — record it once in ",{"type":54,"tag":74,"props":1836,"children":1838},{"className":1837},[],[1839],{"type":60,"value":343},{"type":60,"value":291},{"type":54,"tag":74,"props":1842,"children":1844},{"className":1843},[],[1845],{"type":60,"value":351},{"type":60,"value":1847}," memory and don't re-report it each run. The signal is the rate ",{"type":54,"tag":125,"props":1849,"children":1850},{},[1851],{"type":60,"value":1852},"stepping up",{"type":60,"value":1854},", not its absolute level.",{"type":54,"tag":195,"props":1856,"children":1857},{},[1858,1863,1864,1870,1872,1878,1880,1886,1887,1893,1894,1900,1901,1907],{"type":54,"tag":91,"props":1859,"children":1860},{},[1861],{"type":60,"value":1862},"Dev \u002F test services.",{"type":60,"value":449},{"type":54,"tag":74,"props":1865,"children":1867},{"className":1866},[],[1868],{"type":60,"value":1869},"service.name",{"type":60,"value":1871}," or a resource attribute (",{"type":54,"tag":74,"props":1873,"children":1875},{"className":1874},[],[1876],{"type":60,"value":1877},"deployment.environment",{"type":60,"value":1879},", env) of ",{"type":54,"tag":74,"props":1881,"children":1883},{"className":1882},[],[1884],{"type":60,"value":1885},"dev",{"type":60,"value":81},{"type":54,"tag":74,"props":1888,"children":1890},{"className":1889},[],[1891],{"type":60,"value":1892},"local",{"type":60,"value":81},{"type":54,"tag":74,"props":1895,"children":1897},{"className":1896},[],[1898],{"type":60,"value":1899},"test",{"type":60,"value":81},{"type":54,"tag":74,"props":1902,"children":1904},{"className":1903},[],[1905],{"type":60,"value":1906},"staging",{"type":60,"value":1908},". Filter before weighing.",{"type":54,"tag":195,"props":1910,"children":1911},{},[1912,1917,1918,1924,1925,1931,1932,1938,1939,1945],{"type":54,"tag":91,"props":1913,"children":1914},{},[1915],{"type":60,"value":1916},"Health-check \u002F readiness endpoints.",{"type":60,"value":449},{"type":54,"tag":74,"props":1919,"children":1921},{"className":1920},[],[1922],{"type":60,"value":1923},"\u002Fhealth",{"type":60,"value":345},{"type":54,"tag":74,"props":1926,"children":1928},{"className":1927},[],[1929],{"type":60,"value":1930},"\u002Fhealthz",{"type":60,"value":345},{"type":54,"tag":74,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":60,"value":1937},"\u002Fready",{"type":60,"value":345},{"type":54,"tag":74,"props":1940,"children":1942},{"className":1941},[],[1943],{"type":60,"value":1944},"\u002Flivez",{"type":60,"value":1946}," and the like — high volume, low signal. Allowlist them in memory.",{"type":54,"tag":195,"props":1948,"children":1949},{},[1950,1955,1957,1962],{"type":54,"tag":91,"props":1951,"children":1952},{},[1953],{"type":60,"value":1954},"Cold-start \u002F low-traffic noise.",{"type":60,"value":1956}," A p95 jump on an operation with a tiny ",{"type":54,"tag":74,"props":1958,"children":1960},{"className":1959},[],[1961],{"type":60,"value":750},{"type":60,"value":1963}," (n too small for a stable percentile) is usually a cold start or a single slow trace, not a trend.",{"type":54,"tag":195,"props":1965,"children":1966},{},[1967,1972,1974,1979],{"type":54,"tag":91,"props":1968,"children":1969},{},[1970],{"type":60,"value":1971},"Transient client retries.",{"type":60,"value":1973}," A ",{"type":54,"tag":74,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":60,"value":1196},{"type":60,"value":1980}," span that errors but whose parent ultimately succeeds (retry succeeded) — don't report unless the failure rate itself is climbing.",{"type":54,"tag":195,"props":1982,"children":1983},{},[1984,1989],{"type":54,"tag":91,"props":1985,"children":1986},{},[1987],{"type":60,"value":1988},"Single-trace anomalies.",{"type":60,"value":1990}," One slow or error trace with no recurrence across the window.",{"type":54,"tag":195,"props":1992,"children":1993},{},[1994,1999],{"type":54,"tag":91,"props":1995,"children":1996},{},[1997],{"type":60,"value":1998},"Known upstream provider \u002F DB errors",{"type":60,"value":2000}," already covered by memory — re-report only if the rate or shape changed meaningfully.",{"type":54,"tag":63,"props":2002,"children":2003},{},[2004],{"type":60,"value":2005},"When in doubt, write memory instead of filing a report.",{"type":54,"tag":156,"props":2007,"children":2009},{"id":2008},"mcp-tools",[2010],{"type":60,"value":2011},"MCP tools",{"type":54,"tag":63,"props":2013,"children":2014},{},[2015,2017,2022,2023,2029,2030,2035,2036,2041,2042,2047,2048,2053,2054,2060,2061,2067,2068,2073,2074,2079,2080,2085],{"type":60,"value":2016},"Direct (read-only): ",{"type":54,"tag":74,"props":2018,"children":2020},{"className":2019},[],[2021],{"type":60,"value":203},{"type":60,"value":345},{"type":54,"tag":74,"props":2024,"children":2026},{"className":2025},[],[2027],{"type":60,"value":2028},"apm-spans-aggregate",{"type":60,"value":345},{"type":54,"tag":74,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":60,"value":1090},{"type":60,"value":345},{"type":54,"tag":74,"props":2037,"children":2039},{"className":2038},[],[2040],{"type":60,"value":1252},{"type":60,"value":345},{"type":54,"tag":74,"props":2043,"children":2045},{"className":2044},[],[2046],{"type":60,"value":1298},{"type":60,"value":345},{"type":54,"tag":74,"props":2049,"children":2051},{"className":2050},[],[2052],{"type":60,"value":1378},{"type":60,"value":345},{"type":54,"tag":74,"props":2055,"children":2057},{"className":2056},[],[2058],{"type":60,"value":2059},"apm-attributes-list",{"type":60,"value":345},{"type":54,"tag":74,"props":2062,"children":2064},{"className":2063},[],[2065],{"type":60,"value":2066},"apm-attribute-values-list",{"type":60,"value":345},{"type":54,"tag":74,"props":2069,"children":2071},{"className":2070},[],[2072],{"type":60,"value":219},{"type":60,"value":345},{"type":54,"tag":74,"props":2075,"children":2077},{"className":2076},[],[2078],{"type":60,"value":1106},{"type":60,"value":345},{"type":54,"tag":74,"props":2081,"children":2083},{"className":2082},[],[2084],{"type":60,"value":1138},{"type":60,"value":1505},{"type":54,"tag":63,"props":2087,"children":2088},{},[2089,2091,2096,2097,2102],{"type":60,"value":2090},"Inbox & reviewer routing (mechanics in ",{"type":54,"tag":74,"props":2092,"children":2094},{"className":2093},[],[2095],{"type":60,"value":1630},{"type":60,"value":1632},{"type":54,"tag":74,"props":2098,"children":2100},{"className":2099},[],[2101],{"type":60,"value":1638},{"type":60,"value":2103},"):",{"type":54,"tag":191,"props":2105,"children":2106},{},[2107,2123,2134],{"type":54,"tag":195,"props":2108,"children":2109},{},[2110,2115,2116,2121],{"type":54,"tag":74,"props":2111,"children":2113},{"className":2112},[],[2114],{"type":60,"value":420},{"type":60,"value":81},{"type":54,"tag":74,"props":2117,"children":2119},{"className":2118},[],[2120],{"type":60,"value":476},{"type":60,"value":2122}," — the reports already in the inbox; check before authoring so you edit instead of duplicating.",{"type":54,"tag":195,"props":2124,"children":2125},{},[2126,2132],{"type":54,"tag":74,"props":2127,"children":2129},{"className":2128},[],[2130],{"type":60,"value":2131},"inbox-report-artefacts-list",{"type":60,"value":2133}," — a comparable report's artefact log; reviewer precedent.",{"type":54,"tag":195,"props":2135,"children":2136},{},[2137,2143,2145,2151],{"type":54,"tag":74,"props":2138,"children":2140},{"className":2139},[],[2141],{"type":60,"value":2142},"scout-members-list",{"type":60,"value":2144}," — the in-run roster for routing ",{"type":54,"tag":74,"props":2146,"children":2148},{"className":2147},[],[2149],{"type":60,"value":2150},"suggested_reviewers",{"type":60,"value":2152}," to a service owner.",{"type":54,"tag":63,"props":2154,"children":2155},{},[2156,2158,2164,2165,2170,2171,2176,2177,2182,2183,2188,2189,2194,2196,2202,2203,2209,2211,2216,2218,2223,2224,2229],{"type":60,"value":2157},"Harness-level: ",{"type":54,"tag":74,"props":2159,"children":2161},{"className":2160},[],[2162],{"type":60,"value":2163},"scout-project-profile-get",{"type":60,"value":345},{"type":54,"tag":74,"props":2166,"children":2168},{"className":2167},[],[2169],{"type":60,"value":323},{"type":60,"value":345},{"type":54,"tag":74,"props":2172,"children":2174},{"className":2173},[],[2175],{"type":60,"value":391},{"type":60,"value":345},{"type":54,"tag":74,"props":2178,"children":2180},{"className":2179},[],[2181],{"type":60,"value":399},{"type":60,"value":345},{"type":54,"tag":74,"props":2184,"children":2186},{"className":2185},[],[2187],{"type":60,"value":79},{"type":60,"value":81},{"type":54,"tag":74,"props":2190,"children":2192},{"className":2191},[],[2193],{"type":60,"value":87},{"type":60,"value":2195}," (author \u002F edit a report — the report-channel contract is in the harness prompt), ",{"type":54,"tag":74,"props":2197,"children":2199},{"className":2198},[],[2200],{"type":60,"value":2201},"scout-scratchpad-remember",{"type":60,"value":345},{"type":54,"tag":74,"props":2204,"children":2206},{"className":2205},[],[2207],{"type":60,"value":2208},"scout-scratchpad-forget",{"type":60,"value":2210},". Lean on the bundled ",{"type":54,"tag":74,"props":2212,"children":2214},{"className":2213},[],[2215],{"type":60,"value":281},{"type":60,"value":2217}," skill for query shapes, the ",{"type":54,"tag":74,"props":2219,"children":2221},{"className":2220},[],[2222],{"type":60,"value":289},{"type":60,"value":291},{"type":54,"tag":74,"props":2225,"children":2227},{"className":2226},[],[2228],{"type":60,"value":297},{"type":60,"value":2230}," enums, and the trace-parsing scripts.",{"type":54,"tag":2232,"props":2233,"children":2234},"style",{},[2235],{"type":60,"value":2236},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2238,"total":2355},[2239,2256,2274,2291,2305,2319,2337],{"slug":2240,"name":2240,"fn":2241,"description":2242,"org":2243,"tags":2244,"stars":26,"repoUrl":27,"updatedAt":2255},"analyzing-experiment-session-replays","analyze session replays for PostHog experiments","Analyze session replay patterns across experiment variants to understand user behavior differences. Use when the user wants to see how users interact with different experiment variants, identify usability issues, compare behavior patterns between control and test groups, or get qualitative insights to complement quantitative experiment results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2245,2248,2251,2252],{"name":2246,"slug":2247,"type":15},"Analytics","analytics",{"name":2249,"slug":2250,"type":15},"Design","design",{"name":9,"slug":8,"type":15},{"name":2253,"slug":2254,"type":15},"User Research","user-research","2026-04-06T18:44:38.291781",{"slug":2257,"name":2257,"fn":2258,"description":2259,"org":2260,"tags":2261,"stars":26,"repoUrl":27,"updatedAt":2273},"assessing-heatmaps","analyze page heatmaps and suggest improvements","Assesses what a page's heatmap is telling you and recommends concrete changes. Pulls click \u002F rageclick \u002F scroll-depth data for a URL, names the hot elements by cross-referencing autocapture events on the same page, and can create a saved heatmap the user opens in PostHog, then summarizes the behavior and proposes improvements.\nTRIGGER when: user asks what a heatmap shows, why people aren't clicking something, where users rage-click, how far they scroll, what to change on a page based on heatmap\u002Fclick data, or to 'analyze\u002Fassess\u002Freview the heatmap' for a URL.\nDO NOT TRIGGER when: the user only wants to create a saved heatmap screenshot with no analysis (use heatmaps-saved-create directly), or is asking about session replay in general (use investigating-replay).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2262,2263,2266,2267,2270],{"name":2246,"slug":2247,"type":15},{"name":2264,"slug":2265,"type":15},"Frontend","frontend",{"name":9,"slug":8,"type":15},{"name":2268,"slug":2269,"type":15},"Product Management","product-management",{"name":2271,"slug":2272,"type":15},"UX Design","ux-design","2026-06-05T07:40:43.37798",{"slug":2275,"name":2275,"fn":2276,"description":2277,"org":2278,"tags":2279,"stars":26,"repoUrl":27,"updatedAt":2290},"auditing-experiments-flags","audit PostHog experiments and feature flags","Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2280,2283,2286,2287],{"name":2281,"slug":2282,"type":15},"Audit","audit",{"name":2284,"slug":2285,"type":15},"Feature Flags","feature-flags",{"name":9,"slug":8,"type":15},{"name":2288,"slug":2289,"type":15},"QA","qa","2026-04-06T18:44:30.657553",{"slug":1630,"name":1630,"fn":2292,"description":2293,"org":2294,"tags":2295,"stars":26,"repoUrl":27,"updatedAt":2304},"author and edit PostHog Signals scouts","How to author, edit, and adapt PostHog Signals scouts — the scheduled agents that scan a project and write reports into the Signals inbox. Use when a user wants to customize a canonical scout for their own setup (narrow its scope, retune its thresholds, add disqualifiers), tweak a scout's schedule or dry-run posture, or write a brand-new scout from scratch for a specific use case (a custom event, a product surface no canonical scout covers), or steer a scout without editing it at all by leaving it a note. Covers the scout SKILL.md anatomy, the report contract, the dedupe + scratchpad-memory conventions, the scout-notes steering channel, the per-team skills-store path vs the canonical in-repo path, and the write-and-inspect test loop (with dry-run as an optional safety net). Trigger on \"write\u002Fedit\u002Fcustomize a signals scout\", \"new scout for X\", \"tune my scout schedule\", \"make a scout that watches \u003Cevent>\", \"leave a note for \u002F give feedback to a scout\", \"tell the scouts about X\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2296,2299,2302,2303],{"name":2297,"slug":2298,"type":15},"Agents","agents",{"name":2300,"slug":2301,"type":15},"Automation","automation",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-28T05:33:45.509154",{"slug":2306,"name":2306,"fn":2307,"description":2308,"org":2309,"tags":2310,"stars":26,"repoUrl":27,"updatedAt":2318},"building-a-dashboard","build and update PostHog dashboards","Build a new dashboard, or update an existing one, from a set of insights — the same job the in-app assistant does with its upsert-dashboard tool, but over MCP. Use when a user asks to create a dashboard, put several metrics\u002Fcharts together on one page, assemble a dashboard for a topic (product analytics, retention, revenue, activation, etc.), or add\u002Fremove\u002Freplace insights on a dashboard they already have. Covers deciding create vs update, reusing existing insights vs creating new ones, and using PostHog's vetted dashboard templates as reference for what a strong dashboard on a topic looks like.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2311,2312,2315],{"name":2246,"slug":2247,"type":15},{"name":2313,"slug":2314,"type":15},"Dashboards","dashboards",{"name":2316,"slug":2317,"type":15},"MCP","mcp","2026-07-21T06:07:38.060598",{"slug":2320,"name":2320,"fn":2321,"description":2322,"org":2323,"tags":2324,"stars":26,"repoUrl":27,"updatedAt":2336},"checking-deploy-timing","correlate PostHog deployments with GitHub commits","Determine when a PostHog code change reached a given environment by reading the hidden GIT deploy annotations in the project and correlating them with the merge commit on GitHub. Use when PostHog staff ask \"when was X deployed\", \"is my change live in the US\u002FEU yet\", \"has my PR shipped\", \"did the fix roll out to prod-us\", or otherwise want to know whether\u002Fwhen a commit, PR, or feature went out to a region. Do not answer deploy-timing questions from event\u002Fdata volume alone — that only shows when data changed, not when code shipped.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2325,2328,2331,2334,2335],{"name":2326,"slug":2327,"type":15},"Deployment","deployment",{"name":2329,"slug":2330,"type":15},"Git","git",{"name":2332,"slug":2333,"type":15},"GitHub","github",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-28T07:46:59.53536",{"slug":2338,"name":2338,"fn":2339,"description":2340,"org":2341,"tags":2342,"stars":26,"repoUrl":27,"updatedAt":2354},"choosing-trend-or-slope-view","visualize trends and growth over time","Clarify how to visualize change over a time range before building a trend. Use whenever the user asks how much something changed, grew, dropped, improved, or regressed between two points or periods — \"how much did X change from A to B\", \"before vs after\", \"start vs end\", \"week over week\", \"compare this month to last\", \"change over time\" — or mentions a \"slope chart\" \u002F \"slopegraph\". Two readings of \"change\" need different charts: the whole trend (a line, every interval) versus just the two endpoints (a slope, start vs end). Ask which they want, then render it. Not for choosing a saved insight ChartDisplayType in the insight editor.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2343,2344,2347,2350,2351],{"name":2246,"slug":2247,"type":15},{"name":2345,"slug":2346,"type":15},"Charts","charts",{"name":2348,"slug":2349,"type":15},"Data Visualization","data-visualization",{"name":9,"slug":8,"type":15},{"name":2352,"slug":2353,"type":15},"Reporting","reporting","2026-06-18T08:18:57.960157",56,{"items":2357,"total":2516},[2358,2373,2383,2396,2409,2424,2440,2453,2465,2480,2490,2506],{"slug":2359,"name":2359,"fn":2360,"description":2361,"org":2362,"tags":2363,"stars":2370,"repoUrl":2371,"updatedAt":2372},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2364,2365,2368,2369],{"name":2246,"slug":2247,"type":15},{"name":2366,"slug":2367,"type":15},"Cost Optimization","cost-optimization",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-07-28T05:34:11.117757",{"slug":2374,"name":2374,"fn":2375,"description":2376,"org":2377,"tags":2378,"stars":2370,"repoUrl":2371,"updatedAt":2382},"auditing-endpoints","audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2379,2380,2381],{"name":2246,"slug":2247,"type":15},{"name":2281,"slug":2282,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":2384,"name":2384,"fn":2385,"description":2386,"org":2387,"tags":2388,"stars":2370,"repoUrl":2371,"updatedAt":2395},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2389,2390,2393,2394],{"name":2281,"slug":2282,"type":15},{"name":2391,"slug":2392,"type":15},"Data Warehouse","data-warehouse",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":2397,"name":2397,"fn":2398,"description":2399,"org":2400,"tags":2401,"stars":2370,"repoUrl":2371,"updatedAt":2408},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2402,2403,2404,2407],{"name":2281,"slug":2282,"type":15},{"name":2391,"slug":2392,"type":15},{"name":2405,"slug":2406,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":2410,"name":2410,"fn":2411,"description":2412,"org":2413,"tags":2414,"stars":2370,"repoUrl":2371,"updatedAt":2423},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2415,2418,2421,2422],{"name":2416,"slug":2417,"type":15},"Alerting","alerting",{"name":2419,"slug":2420,"type":15},"Debugging","debugging",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":2425,"name":2425,"fn":2426,"description":2427,"org":2428,"tags":2429,"stars":2370,"repoUrl":2371,"updatedAt":2439},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2430,2431,2434,2435,2438],{"name":2246,"slug":2247,"type":15},{"name":2432,"slug":2433,"type":15},"Monitoring","monitoring",{"name":13,"slug":14,"type":15},{"name":2436,"slug":2437,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},"2026-07-18T05:10:54.430898",{"slug":2441,"name":2441,"fn":2442,"description":2443,"org":2444,"tags":2445,"stars":2370,"repoUrl":2371,"updatedAt":2452},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2446,2447,2448,2449],{"name":2300,"slug":2301,"type":15},{"name":2316,"slug":2317,"type":15},{"name":9,"slug":8,"type":15},{"name":2450,"slug":2451,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":2454,"name":2454,"fn":2455,"description":2456,"org":2457,"tags":2458,"stars":2370,"repoUrl":2371,"updatedAt":2464},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2459,2460,2461,2462,2463],{"name":2246,"slug":2247,"type":15},{"name":2419,"slug":2420,"type":15},{"name":2264,"slug":2265,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":2466,"name":2466,"fn":2467,"description":2468,"org":2469,"tags":2470,"stars":2370,"repoUrl":2371,"updatedAt":2479},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2471,2474,2475,2476],{"name":2472,"slug":2473,"type":15},"API Development","api-development",{"name":2264,"slug":2265,"type":15},{"name":9,"slug":8,"type":15},{"name":2477,"slug":2478,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":2481,"name":2481,"fn":2482,"description":2483,"org":2484,"tags":2485,"stars":2370,"repoUrl":2371,"updatedAt":2489},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2486,2487,2488],{"name":2472,"slug":2473,"type":15},{"name":2436,"slug":2437,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":2491,"name":2491,"fn":2492,"description":2493,"org":2494,"tags":2495,"stars":2370,"repoUrl":2371,"updatedAt":2505},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2496,2497,2500,2501,2502],{"name":2300,"slug":2301,"type":15},{"name":2498,"slug":2499,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":2352,"slug":2353,"type":15},{"name":2503,"slug":2504,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":2507,"name":2507,"fn":2508,"description":2509,"org":2510,"tags":2511,"stars":2370,"repoUrl":2371,"updatedAt":2515},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2512,2513,2514],{"name":2246,"slug":2247,"type":15},{"name":2472,"slug":2473,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231]