[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-signals-scout-insight-alerts":3,"mdc--igkv8v-key":38,"related-repo-posthog-signals-scout-insight-alerts":1748,"related-org-posthog-signals-scout-insight-alerts":1865},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":33,"sourceUrl":36,"mdContent":37},"signals-scout-insight-alerts","scout PostHog insight alerts","Signals scout over a project's own configured insight alerts. Reads each alert's recent firing history and files a report for the firings a human likely missed — especially ones the standard notification path stayed silent on.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Alerting","alerting",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Analytics","analytics",59,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fai-plugin","2026-07-18T05:11:36.463818",null,11,[29,30,31,32],"claude-code-plugin","codex-plugin","cursor-plugin","gemini-cli-extension",{"repoUrl":24,"stars":23,"forks":27,"topics":34,"description":35},[29,30,31,32],"Official PostHog plugin for Claude Code, Cursor, Gemini, Codex and other AI coding tools","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fai-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fsignals-scout-insight-alerts","---\nname: signals-scout-insight-alerts\ndescription: >\n Signals scout over a project's own configured insight alerts. Reads each alert's recent\n firing history and files a report for the firings a human likely missed — especially ones\n the standard notification path stayed silent on.\ncompatibility: >\n PostHog Signals agent (Claude sandbox). Read-only analytics + signal_scout_internal:write\n (scratchpad) + signal_scout_report:write (report channel), plus the alert tools (alerts-list,\n alert-get), insight-get, and the inbox tools in the MCP tools section.\nallowed_tools:\n - emit_report\n - edit_report\nmetadata:\n owner_team: signals\n scope: insight_alerts\n---\n\n# Signals scout: configured insight-alert firings\n\nYou are a focused digest-and-triage scout over the project's **own configured insight alerts** (the threshold and anomaly-detector alerts users set on insights). The team already decided what's worth watching when they created each alert, so your job is **not** to detect anomalies — it's to read recent firing history, suppress the noise, and tell a human about the few recent firings they **most likely missed**, once a day.\n\nYou author reports directly via the report channel (`scout-emit-report` \u002F `scout-edit-report`): you've triaged the firing history yourself, so you own each report 1:1 end-to-end rather than firing weak signals for a pipeline to cluster. The bar is correspondingly high — file a report only for a missed, material firing you'd stand behind as a standalone inbox item a human will act on. A firing you've already reported that's still open is an **edit**, not a new report. The harness prompt carries the full report-channel contract (fields, status mapping, reviewer routing, dedupe, and the edit rules); this body adds only the insight-alerts-specific framing.\n\n**The discriminator.** A finding is a _recent firing the team likely missed_. Because the user set the threshold themselves, a firing is presumptively meaningful — you triage, you don't re-detect. Rank each recent firing by **missed-ness × materiality × persistence**:\n\n- **Missed-ness** — _did anyone actually get told?_ A firing with no `notification_sent_at`, empty `targets_notified`, or no subscribed users, and a firing where `notification_suppressed_by_agent` is true (the investigation agent swallowed it — could be a false negative), are the **highest-value** signals: the normal alert pipeline stayed silent. A firing that already emailed\u002FSlacked its subscribers is lower-value — they saw it. This is the whole reason you exist: **you catch what the notification path didn't.**\n- **Materiality** — how far `calculated_value` sits past the threshold bound, or how high the detector anomaly score. A 3× breach beats a marginal one sitting right on the bound.\n- **Persistence** — a firing sustained across consecutive checks (still open, `state=Firing`) outranks a single flap that already self-resolved between two checks.\n\nInternalize that ordering; it's the whole game. An alert that's silently **Errored** (no longer evaluating) is a blind spot worth a low-severity callout, but it is _not_ a firing.\n\n## Quick close-out: are there even alerts firing?\n\nCheap read first: `alerts-list`. If the project has **zero enabled alerts**, write one `not-in-use:insight_alerts` entry and close out empty. If every enabled alert is `Not firing`, nothing was `last_notified_at` inside your window, and no alert is `Errored`, write\u002Frefresh `pattern:insight_alerts:baseline` and close out — the configured alerts are all quiet, which is a real outcome. (Re-using either key idempotently refreshes it.)\n\n## How a run works\n\nCycle between these moves; skip what's not useful.\n\n### Get oriented\n\n- `scout-scratchpad-search` (`text=insight_alerts`, `limit=100`) — your durable steering: the baseline, which alerts you've already surfaced (`dedupe:`), which are known flappy\u002Ftest (`noise:`), which the team has muted or fixed (`addressed:`\u002F`allowlist:`), which report covers a firing (`report:`), and who owns an alert (`reviewer:`).\n- `scout-runs-list` (last 7d) — what prior runs of this scout surfaced and ruled out, so you don't re-file yesterday's digest.\n- `alerts-list` — the cheap triage layer over **every** alert at once. Read each row's `state`, `enabled`, `snoozed_until`, `last_notified_at`, `last_checked_at`, `last_value`, `calculation_interval`, and threshold\u002F`condition`\u002F`detector_config`. This is your candidate funnel — don't pull per-alert history for all of them.\n- `inbox-reports-list` (`ordering=-updated_at`, `search`=the specific alert or insight name) — the reports already in the inbox. Your own report-channel reports persist their backing signals under `source_product=signals_scout`, so don't filter by product — you'd miss every report you authored. A firing on an alert you've reported before is an **edit**, not a fresh report; pull the closest matches with `inbox-reports-retrieve` before authoring.\n\n### Narrow to candidates (this matters on big projects)\n\nA busy project can have hundreds of alerts; you cannot deep-read them all every run. From `alerts-list`, keep only the alerts that are **enabled, not snoozed**, and match any of:\n\n- `state` is `Firing` — currently breaching.\n- `state` is `Errored` — silently not evaluating (a coverage blind spot).\n- `last_notified_at` or `last_checked_at` falls inside your lookback window (default ~last 24h, a bit wider on a daily run) — fired and may have already resolved.\n\nEverything else (`Not firing`, untouched in the window) is baseline — skip it. This typically takes a few hundred alerts down to a handful.\n\n### Deep-read each candidate\n\nFor each surviving candidate, pull the real firing episode — never trust `state`\u002F`last_value` alone (state can be stale, and `last_value` is just the latest check, not the breach that fired). Use `alert-get` with `checks_date_from=-24h` (widen to `-48h`\u002F`-7d` to judge persistence and recurrence; history is retained 14 days). Read across the returned `checks`:\n\n| Shape in the checks | What it usually means |\n| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |\n| One or more `Firing` checks, latest still `Firing`, no `notification_sent_at` | **Silent open breach — top priority.** Fired, nobody was told, still going. |\n| `Firing` checks then back to `Not firing`, all within minutes\u002Fone interval | A **flap** — usually a badly-tuned threshold, not an incident. Hygiene, not a P1. |\n| `Firing` with `notification_sent_at` set + subscribed users | The team was told. Lower value; surface only if material **and** still open\u002Funacted. |\n| `notification_suppressed_by_agent=true` | Investigation agent judged it a false positive — verify before trusting; possible false negative. |\n| Repeated `error` across consecutive checks (`state=Errored`) | Alert is broken (bad query, deleted insight, missing series) — a silent blind spot. |\n\nWhen in doubt about whether a breach is real, read the alert's `condition`\u002Fthreshold bounds and compare them against the firing check's `calculated_value`, and pull the insight with `insight-get` to understand what the metric is.\n\n### Save memory as you go\n\nWrite a scratchpad entry whenever a future run should change behavior. Encode the category in the key prefix; key per-alert entries on the **alert id** (stable across firings).\n\n- `pattern:insight_alerts:baseline` — \"~{N} enabled alerts, ~{X} firing\u002Fday, mostly hourly; many owners. {timestamp}\"\n- `dedupe:insight_alerts:{alert_id}` — \"Surfaced firing of '{name}' (alert {alert_id}, insight {short_id}) on {date}, value {v} vs bound {b}, silent. If still Firing next run, edit the report; if resolved + notified, treat as covered.\"\n- `noise:insight_alerts:{alert_id}` — \"flaps every few hours on a too-tight bound; the firing itself isn't signal. Only surface as a one-off tuning hygiene finding, never per-flap.\"\n- `addressed:insight_alerts:{alert_id}` \u002F `allowlist:insight_alerts:{alert_id}` — team fixed \u002F acked it, or owner deliberately keeps it low-priority — skip.\n- `report:insight_alerts:{alert_id}` — the `report_id` of a report you filed for a firing on this alert, so the next run edits it (append_note with the fresh firing) instead of duplicating.\n- `reviewer:insight_alerts:{alert_id}` — a resolved owner (bare lowercase GitHub login) for an alert or its insight, so reports route to a human faster.\n\n### Decide\n\nThe generic report mechanics — search the inbox first (via the `report:insight_alerts:{alert_id}` pointer, else an `inbox-reports-list` search on the specific alert \u002F insight name, not a broad word like `alert`), edit-vs-author, the status rules, reviewer routing, non-idempotent dedup, and the `priority` \u002F `repository` fields — live in the harness prompt and in `authoring-scouts` → `references\u002Freport-contract.md`. Do not re-derive them here. Classify each candidate firing against prior runs and the scratchpad (net-new \u002F material-update \u002F already-covered \u002F addressed-or-noise), then apply only the insight-alerts judgment:\n\n- **Edit** when a still-live report already tracks the alert — a firing you surfaced that's still open, or a recurrence on the same alert. A persistent breach is one report across runs: `append_note` the fresh firing (`calculated_value` vs bound, the new fired-at, current notification status), not a fresh report per day.\n- **Author** when nothing live covers the firing. A report-worthy finding is an enabled, un-snoozed alert with a **material** firing (well past its bound or a high anomaly score) inside the window that was **under-notified** (silent \u002F suppressed) or is **still open and unacted**, with the alert id, insight `short_id`, the firing `calculated_value` vs the threshold bound, the fired-at time, and the notification status in the `evidence`. This is a triage callout, not a code fix → `actionability=requires_human_input`. Priority: a material, silent firing on a clearly important metric is **P1**; a material firing that was notified but is still open\u002Funacted is **P2**; Errored-alert blind spots and flapping-threshold hygiene are **P3**.\n- **Cap and rank.** File at most ~5 reports per run, worst-first by the discriminator. If more cleared the bar, say how many you dropped in the close-out — never silently truncate. One digest-style report that bundles several minor firings is fine when none individually warrants its own entry; bundle the flapping\u002FErrored hygiene items this way rather than one report each.\n- **Remember** if it's suggestive but below the bar (a marginal breach, a single flap), or to refresh the baseline \u002F record what you ruled out.\n- **Skip** if a `noise:` \u002F `addressed:` \u002F `allowlist:` \u002F `dedupe:` entry, or an existing inbox report, already covers it.\n\nSibling courtesy: `observability-gaps` recommends _creating_ alerts and `anomaly-detection` scores the insights the team _views_ (whether or not they're alerted) — you own the firings of alerts that already exist. Honor their `dedupe:` entries; your unique angle is the missed-firing triage frame.\n\n### Close out\n\nOne paragraph: how many alerts you triaged, which reports you authored or edited (and why those), what you ruled out (flaps, snoozed, already-notified-and-resolved), and how many cleared the bar but were dropped for the per-run cap. The harness saves this as the run summary. \"Triaged the candidates, everything firing was already notified and acted on\" is a real outcome — do not write a separate run-metadata scratchpad entry.\n\n## Disqualifiers (skip these)\n\n- **Snoozed or disabled alerts** — `snoozed_until` in the future, or `enabled=false`. The owner explicitly muted these; a firing on a snoozed alert is not a miss.\n- **Flapping alerts** — fire→resolve→fire within an interval with no sustained breach. That's a tuning problem, not an incident. At most **one** hygiene finding (P3) suggesting the bound be retuned; record `noise:` and stop surfacing the individual flaps.\n- **Already-notified-and-resolved** — fired, the subscribed users were emailed\u002FSlacked (`notification_sent_at` set), and it's back to `Not firing`. The team saw it and it's over; skip unless it's materially recurring across days.\n- **Marginal breaches on low-count\u002Fnoisy series** — `calculated_value` sitting right on the bound, or a tiny absolute count. Below the materiality floor; remember, don't report.\n- **Dev \u002F test \u002F internal-only alerts** — alerts on insights whose `$environment`\u002Fservice is `dev`\u002F`local`\u002F`test`, or a single owner's sandbox alert. Not user-facing.\n- **Transient single-check errors** — an alert that errored once and recovered. Only flag **persistent** Errored state across consecutive checks.\n\nWhen in doubt, refresh memory instead of filing a report.\n\n## MCP tools\n\nDirect (read-only):\n\n- `alerts-list` — the cheap triage layer over every alert (state, enabled, snoozed, last_notified\u002Fchecked, last_value, threshold\u002Fdetector). Your candidate funnel.\n- `alert-get` (`id`, `checks_date_from`, `checks_date_to`, `checks_limit`) — the real firing history for one candidate: per-check `state`, `calculated_value`, `targets_notified`, `notification_sent_at`, `notification_suppressed_by_agent`, `error`, anomaly scores.\n- `insight-get` — what the alerted metric actually is (read when judging materiality).\n\nInbox & reviewer routing (mechanics in `authoring-scouts` → `references\u002Freport-contract.md`):\n\n- `inbox-reports-list` \u002F `inbox-reports-retrieve` — the reports already in the inbox; check before authoring so you edit instead of duplicating.\n- `inbox-report-artefacts-list` — a comparable report's artefact log; reviewer precedent.\n- `scout-members-list` — the in-run roster for routing `suggested_reviewers` to an alert \u002F insight owner.\n\nHarness-level: `scout-project-profile-get`, `scout-scratchpad-search`, `scout-runs-list`, `scout-runs-retrieve` (orientation + dedupe); `scout-emit-report` \u002F `scout-edit-report` (author \u002F edit a report — the report-channel contract is in the harness prompt); `scout-scratchpad-remember`, `scout-scratchpad-forget` (memory).\n\n## When to stop\n\n- No enabled alerts, or everything quiet → quick close-out.\n- You've triaged the candidates and surfaced the worst few → close out, even if minor firings remain; the per-run cap is deliberate.\n- A candidate matches a `noise:` \u002F `addressed:` \u002F `allowlist:` \u002F `dedupe:` entry → skip.\n\nFewer, well-calibrated findings that genuinely catch missed firings beat a daily re-list of every alert that happened to breach.\n",{"data":39,"body":47},{"name":4,"description":6,"compatibility":40,"allowed_tools":41,"metadata":44},"PostHog Signals agent (Claude sandbox). Read-only analytics + signal_scout_internal:write (scratchpad) + signal_scout_report:write (report channel), plus the alert tools (alerts-list, alert-get), insight-get, and the inbox tools in the MCP tools section.\n",[42,43],"emit_report","edit_report",{"owner_team":45,"scope":46},"signals","insight_alerts",{"type":48,"children":49},"root",[50,59,87,116,141,235,253,260,319,325,330,337,554,560,579,633,645,651,714,888,915,921,933,1016,1022,1080,1246,1288,1294,1299,1305,1453,1458,1464,1469,1567,1585,1634,1694,1700,1743],{"type":51,"tag":52,"props":53,"children":55},"element","h1",{"id":54},"signals-scout-configured-insight-alert-firings",[56],{"type":57,"value":58},"text","Signals scout: configured insight-alert firings",{"type":51,"tag":60,"props":61,"children":62},"p",{},[63,65,71,73,78,80,85],{"type":57,"value":64},"You are a focused digest-and-triage scout over the project's ",{"type":51,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":57,"value":70},"own configured insight alerts",{"type":57,"value":72}," (the threshold and anomaly-detector alerts users set on insights). The team already decided what's worth watching when they created each alert, so your job is ",{"type":51,"tag":66,"props":74,"children":75},{},[76],{"type":57,"value":77},"not",{"type":57,"value":79}," to detect anomalies — it's to read recent firing history, suppress the noise, and tell a human about the few recent firings they ",{"type":51,"tag":66,"props":81,"children":82},{},[83],{"type":57,"value":84},"most likely missed",{"type":57,"value":86},", once a day.",{"type":51,"tag":60,"props":88,"children":89},{},[90,92,99,101,107,109,114],{"type":57,"value":91},"You author reports directly via the report channel (",{"type":51,"tag":93,"props":94,"children":96},"code",{"className":95},[],[97],{"type":57,"value":98},"scout-emit-report",{"type":57,"value":100}," \u002F ",{"type":51,"tag":93,"props":102,"children":104},{"className":103},[],[105],{"type":57,"value":106},"scout-edit-report",{"type":57,"value":108},"): you've triaged the firing history yourself, so you own each report 1:1 end-to-end rather than firing weak signals for a pipeline to cluster. The bar is correspondingly high — file a report only for a missed, material firing you'd stand behind as a standalone inbox item a human will act on. A firing you've already reported that's still open is an ",{"type":51,"tag":66,"props":110,"children":111},{},[112],{"type":57,"value":113},"edit",{"type":57,"value":115},", not a new report. The harness prompt carries the full report-channel contract (fields, status mapping, reviewer routing, dedupe, and the edit rules); this body adds only the insight-alerts-specific framing.",{"type":51,"tag":60,"props":117,"children":118},{},[119,124,126,132,134,139],{"type":51,"tag":66,"props":120,"children":121},{},[122],{"type":57,"value":123},"The discriminator.",{"type":57,"value":125}," A finding is a ",{"type":51,"tag":127,"props":128,"children":129},"em",{},[130],{"type":57,"value":131},"recent firing the team likely missed",{"type":57,"value":133},". Because the user set the threshold themselves, a firing is presumptively meaningful — you triage, you don't re-detect. Rank each recent firing by ",{"type":51,"tag":66,"props":135,"children":136},{},[137],{"type":57,"value":138},"missed-ness × materiality × persistence",{"type":57,"value":140},":",{"type":51,"tag":142,"props":143,"children":144},"ul",{},[145,199,217],{"type":51,"tag":146,"props":147,"children":148},"li",{},[149,154,156,161,163,169,171,177,179,185,187,192,194],{"type":51,"tag":66,"props":150,"children":151},{},[152],{"type":57,"value":153},"Missed-ness",{"type":57,"value":155}," — ",{"type":51,"tag":127,"props":157,"children":158},{},[159],{"type":57,"value":160},"did anyone actually get told?",{"type":57,"value":162}," A firing with no ",{"type":51,"tag":93,"props":164,"children":166},{"className":165},[],[167],{"type":57,"value":168},"notification_sent_at",{"type":57,"value":170},", empty ",{"type":51,"tag":93,"props":172,"children":174},{"className":173},[],[175],{"type":57,"value":176},"targets_notified",{"type":57,"value":178},", or no subscribed users, and a firing where ",{"type":51,"tag":93,"props":180,"children":182},{"className":181},[],[183],{"type":57,"value":184},"notification_suppressed_by_agent",{"type":57,"value":186}," is true (the investigation agent swallowed it — could be a false negative), are the ",{"type":51,"tag":66,"props":188,"children":189},{},[190],{"type":57,"value":191},"highest-value",{"type":57,"value":193}," signals: the normal alert pipeline stayed silent. A firing that already emailed\u002FSlacked its subscribers is lower-value — they saw it. This is the whole reason you exist: ",{"type":51,"tag":66,"props":195,"children":196},{},[197],{"type":57,"value":198},"you catch what the notification path didn't.",{"type":51,"tag":146,"props":200,"children":201},{},[202,207,209,215],{"type":51,"tag":66,"props":203,"children":204},{},[205],{"type":57,"value":206},"Materiality",{"type":57,"value":208}," — how far ",{"type":51,"tag":93,"props":210,"children":212},{"className":211},[],[213],{"type":57,"value":214},"calculated_value",{"type":57,"value":216}," sits past the threshold bound, or how high the detector anomaly score. A 3× breach beats a marginal one sitting right on the bound.",{"type":51,"tag":146,"props":218,"children":219},{},[220,225,227,233],{"type":51,"tag":66,"props":221,"children":222},{},[223],{"type":57,"value":224},"Persistence",{"type":57,"value":226}," — a firing sustained across consecutive checks (still open, ",{"type":51,"tag":93,"props":228,"children":230},{"className":229},[],[231],{"type":57,"value":232},"state=Firing",{"type":57,"value":234},") outranks a single flap that already self-resolved between two checks.",{"type":51,"tag":60,"props":236,"children":237},{},[238,240,245,247,251],{"type":57,"value":239},"Internalize that ordering; it's the whole game. An alert that's silently ",{"type":51,"tag":66,"props":241,"children":242},{},[243],{"type":57,"value":244},"Errored",{"type":57,"value":246}," (no longer evaluating) is a blind spot worth a low-severity callout, but it is ",{"type":51,"tag":127,"props":248,"children":249},{},[250],{"type":57,"value":77},{"type":57,"value":252}," a firing.",{"type":51,"tag":254,"props":255,"children":257},"h2",{"id":256},"quick-close-out-are-there-even-alerts-firing",[258],{"type":57,"value":259},"Quick close-out: are there even alerts firing?",{"type":51,"tag":60,"props":261,"children":262},{},[263,265,271,273,278,280,286,288,294,296,302,304,309,311,317],{"type":57,"value":264},"Cheap read first: ",{"type":51,"tag":93,"props":266,"children":268},{"className":267},[],[269],{"type":57,"value":270},"alerts-list",{"type":57,"value":272},". If the project has ",{"type":51,"tag":66,"props":274,"children":275},{},[276],{"type":57,"value":277},"zero enabled alerts",{"type":57,"value":279},", write one ",{"type":51,"tag":93,"props":281,"children":283},{"className":282},[],[284],{"type":57,"value":285},"not-in-use:insight_alerts",{"type":57,"value":287}," entry and close out empty. If every enabled alert is ",{"type":51,"tag":93,"props":289,"children":291},{"className":290},[],[292],{"type":57,"value":293},"Not firing",{"type":57,"value":295},", nothing was ",{"type":51,"tag":93,"props":297,"children":299},{"className":298},[],[300],{"type":57,"value":301},"last_notified_at",{"type":57,"value":303}," inside your window, and no alert is ",{"type":51,"tag":93,"props":305,"children":307},{"className":306},[],[308],{"type":57,"value":244},{"type":57,"value":310},", write\u002Frefresh ",{"type":51,"tag":93,"props":312,"children":314},{"className":313},[],[315],{"type":57,"value":316},"pattern:insight_alerts:baseline",{"type":57,"value":318}," and close out — the configured alerts are all quiet, which is a real outcome. (Re-using either key idempotently refreshes it.)",{"type":51,"tag":254,"props":320,"children":322},{"id":321},"how-a-run-works",[323],{"type":57,"value":324},"How a run works",{"type":51,"tag":60,"props":326,"children":327},{},[328],{"type":57,"value":329},"Cycle between these moves; skip what's not useful.",{"type":51,"tag":331,"props":332,"children":334},"h3",{"id":333},"get-oriented",[335],{"type":57,"value":336},"Get oriented",{"type":51,"tag":142,"props":338,"children":339},{},[340,415,426,507],{"type":51,"tag":146,"props":341,"children":342},{},[343,349,351,357,359,365,367,373,375,381,383,389,391,397,399,405,407,413],{"type":51,"tag":93,"props":344,"children":346},{"className":345},[],[347],{"type":57,"value":348},"scout-scratchpad-search",{"type":57,"value":350}," (",{"type":51,"tag":93,"props":352,"children":354},{"className":353},[],[355],{"type":57,"value":356},"text=insight_alerts",{"type":57,"value":358},", ",{"type":51,"tag":93,"props":360,"children":362},{"className":361},[],[363],{"type":57,"value":364},"limit=100",{"type":57,"value":366},") — your durable steering: the baseline, which alerts you've already surfaced (",{"type":51,"tag":93,"props":368,"children":370},{"className":369},[],[371],{"type":57,"value":372},"dedupe:",{"type":57,"value":374},"), which are known flappy\u002Ftest (",{"type":51,"tag":93,"props":376,"children":378},{"className":377},[],[379],{"type":57,"value":380},"noise:",{"type":57,"value":382},"), which the team has muted or fixed (",{"type":51,"tag":93,"props":384,"children":386},{"className":385},[],[387],{"type":57,"value":388},"addressed:",{"type":57,"value":390},"\u002F",{"type":51,"tag":93,"props":392,"children":394},{"className":393},[],[395],{"type":57,"value":396},"allowlist:",{"type":57,"value":398},"), which report covers a firing (",{"type":51,"tag":93,"props":400,"children":402},{"className":401},[],[403],{"type":57,"value":404},"report:",{"type":57,"value":406},"), and who owns an alert (",{"type":51,"tag":93,"props":408,"children":410},{"className":409},[],[411],{"type":57,"value":412},"reviewer:",{"type":57,"value":414},").",{"type":51,"tag":146,"props":416,"children":417},{},[418,424],{"type":51,"tag":93,"props":419,"children":421},{"className":420},[],[422],{"type":57,"value":423},"scout-runs-list",{"type":57,"value":425}," (last 7d) — what prior runs of this scout surfaced and ruled out, so you don't re-file yesterday's digest.",{"type":51,"tag":146,"props":427,"children":428},{},[429,434,436,441,443,449,450,456,457,463,464,469,470,476,477,483,484,490,492,498,499,505],{"type":51,"tag":93,"props":430,"children":432},{"className":431},[],[433],{"type":57,"value":270},{"type":57,"value":435}," — the cheap triage layer over ",{"type":51,"tag":66,"props":437,"children":438},{},[439],{"type":57,"value":440},"every",{"type":57,"value":442}," alert at once. Read each row's ",{"type":51,"tag":93,"props":444,"children":446},{"className":445},[],[447],{"type":57,"value":448},"state",{"type":57,"value":358},{"type":51,"tag":93,"props":451,"children":453},{"className":452},[],[454],{"type":57,"value":455},"enabled",{"type":57,"value":358},{"type":51,"tag":93,"props":458,"children":460},{"className":459},[],[461],{"type":57,"value":462},"snoozed_until",{"type":57,"value":358},{"type":51,"tag":93,"props":465,"children":467},{"className":466},[],[468],{"type":57,"value":301},{"type":57,"value":358},{"type":51,"tag":93,"props":471,"children":473},{"className":472},[],[474],{"type":57,"value":475},"last_checked_at",{"type":57,"value":358},{"type":51,"tag":93,"props":478,"children":480},{"className":479},[],[481],{"type":57,"value":482},"last_value",{"type":57,"value":358},{"type":51,"tag":93,"props":485,"children":487},{"className":486},[],[488],{"type":57,"value":489},"calculation_interval",{"type":57,"value":491},", and threshold\u002F",{"type":51,"tag":93,"props":493,"children":495},{"className":494},[],[496],{"type":57,"value":497},"condition",{"type":57,"value":390},{"type":51,"tag":93,"props":500,"children":502},{"className":501},[],[503],{"type":57,"value":504},"detector_config",{"type":57,"value":506},". This is your candidate funnel — don't pull per-alert history for all of them.",{"type":51,"tag":146,"props":508,"children":509},{},[510,516,517,523,524,530,532,538,540,544,546,552],{"type":51,"tag":93,"props":511,"children":513},{"className":512},[],[514],{"type":57,"value":515},"inbox-reports-list",{"type":57,"value":350},{"type":51,"tag":93,"props":518,"children":520},{"className":519},[],[521],{"type":57,"value":522},"ordering=-updated_at",{"type":57,"value":358},{"type":51,"tag":93,"props":525,"children":527},{"className":526},[],[528],{"type":57,"value":529},"search",{"type":57,"value":531},"=the specific alert or insight name) — the reports already in the inbox. Your own report-channel reports persist their backing signals under ",{"type":51,"tag":93,"props":533,"children":535},{"className":534},[],[536],{"type":57,"value":537},"source_product=signals_scout",{"type":57,"value":539},", so don't filter by product — you'd miss every report you authored. A firing on an alert you've reported before is an ",{"type":51,"tag":66,"props":541,"children":542},{},[543],{"type":57,"value":113},{"type":57,"value":545},", not a fresh report; pull the closest matches with ",{"type":51,"tag":93,"props":547,"children":549},{"className":548},[],[550],{"type":57,"value":551},"inbox-reports-retrieve",{"type":57,"value":553}," before authoring.",{"type":51,"tag":331,"props":555,"children":557},{"id":556},"narrow-to-candidates-this-matters-on-big-projects",[558],{"type":57,"value":559},"Narrow to candidates (this matters on big projects)",{"type":51,"tag":60,"props":561,"children":562},{},[563,565,570,572,577],{"type":57,"value":564},"A busy project can have hundreds of alerts; you cannot deep-read them all every run. From ",{"type":51,"tag":93,"props":566,"children":568},{"className":567},[],[569],{"type":57,"value":270},{"type":57,"value":571},", keep only the alerts that are ",{"type":51,"tag":66,"props":573,"children":574},{},[575],{"type":57,"value":576},"enabled, not snoozed",{"type":57,"value":578},", and match any of:",{"type":51,"tag":142,"props":580,"children":581},{},[582,600,616],{"type":51,"tag":146,"props":583,"children":584},{},[585,590,592,598],{"type":51,"tag":93,"props":586,"children":588},{"className":587},[],[589],{"type":57,"value":448},{"type":57,"value":591}," is ",{"type":51,"tag":93,"props":593,"children":595},{"className":594},[],[596],{"type":57,"value":597},"Firing",{"type":57,"value":599}," — currently breaching.",{"type":51,"tag":146,"props":601,"children":602},{},[603,608,609,614],{"type":51,"tag":93,"props":604,"children":606},{"className":605},[],[607],{"type":57,"value":448},{"type":57,"value":591},{"type":51,"tag":93,"props":610,"children":612},{"className":611},[],[613],{"type":57,"value":244},{"type":57,"value":615}," — silently not evaluating (a coverage blind spot).",{"type":51,"tag":146,"props":617,"children":618},{},[619,624,626,631],{"type":51,"tag":93,"props":620,"children":622},{"className":621},[],[623],{"type":57,"value":301},{"type":57,"value":625}," or ",{"type":51,"tag":93,"props":627,"children":629},{"className":628},[],[630],{"type":57,"value":475},{"type":57,"value":632}," falls inside your lookback window (default ~last 24h, a bit wider on a daily run) — fired and may have already resolved.",{"type":51,"tag":60,"props":634,"children":635},{},[636,638,643],{"type":57,"value":637},"Everything else (",{"type":51,"tag":93,"props":639,"children":641},{"className":640},[],[642],{"type":57,"value":293},{"type":57,"value":644},", untouched in the window) is baseline — skip it. This typically takes a few hundred alerts down to a handful.",{"type":51,"tag":331,"props":646,"children":648},{"id":647},"deep-read-each-candidate",[649],{"type":57,"value":650},"Deep-read each candidate",{"type":51,"tag":60,"props":652,"children":653},{},[654,656,661,662,667,669,674,676,682,684,690,692,698,699,705,707,713],{"type":57,"value":655},"For each surviving candidate, pull the real firing episode — never trust ",{"type":51,"tag":93,"props":657,"children":659},{"className":658},[],[660],{"type":57,"value":448},{"type":57,"value":390},{"type":51,"tag":93,"props":663,"children":665},{"className":664},[],[666],{"type":57,"value":482},{"type":57,"value":668}," alone (state can be stale, and ",{"type":51,"tag":93,"props":670,"children":672},{"className":671},[],[673],{"type":57,"value":482},{"type":57,"value":675}," is just the latest check, not the breach that fired). Use ",{"type":51,"tag":93,"props":677,"children":679},{"className":678},[],[680],{"type":57,"value":681},"alert-get",{"type":57,"value":683}," with ",{"type":51,"tag":93,"props":685,"children":687},{"className":686},[],[688],{"type":57,"value":689},"checks_date_from=-24h",{"type":57,"value":691}," (widen to ",{"type":51,"tag":93,"props":693,"children":695},{"className":694},[],[696],{"type":57,"value":697},"-48h",{"type":57,"value":390},{"type":51,"tag":93,"props":700,"children":702},{"className":701},[],[703],{"type":57,"value":704},"-7d",{"type":57,"value":706}," to judge persistence and recurrence; history is retained 14 days). Read across the returned ",{"type":51,"tag":93,"props":708,"children":710},{"className":709},[],[711],{"type":57,"value":712},"checks",{"type":57,"value":140},{"type":51,"tag":715,"props":716,"children":717},"table",{},[718,737],{"type":51,"tag":719,"props":720,"children":721},"thead",{},[722],{"type":51,"tag":723,"props":724,"children":725},"tr",{},[726,732],{"type":51,"tag":727,"props":728,"children":729},"th",{},[730],{"type":57,"value":731},"Shape in the checks",{"type":51,"tag":727,"props":733,"children":734},{},[735],{"type":57,"value":736},"What it usually means",{"type":51,"tag":738,"props":739,"children":740},"tbody",{},[741,779,811,842,859],{"type":51,"tag":723,"props":742,"children":743},{},[744,769],{"type":51,"tag":745,"props":746,"children":747},"td",{},[748,750,755,757,762,764],{"type":57,"value":749},"One or more ",{"type":51,"tag":93,"props":751,"children":753},{"className":752},[],[754],{"type":57,"value":597},{"type":57,"value":756}," checks, latest still ",{"type":51,"tag":93,"props":758,"children":760},{"className":759},[],[761],{"type":57,"value":597},{"type":57,"value":763},", no ",{"type":51,"tag":93,"props":765,"children":767},{"className":766},[],[768],{"type":57,"value":168},{"type":51,"tag":745,"props":770,"children":771},{},[772,777],{"type":51,"tag":66,"props":773,"children":774},{},[775],{"type":57,"value":776},"Silent open breach — top priority.",{"type":57,"value":778}," Fired, nobody was told, still going.",{"type":51,"tag":723,"props":780,"children":781},{},[782,799],{"type":51,"tag":745,"props":783,"children":784},{},[785,790,792,797],{"type":51,"tag":93,"props":786,"children":788},{"className":787},[],[789],{"type":57,"value":597},{"type":57,"value":791}," checks then back to ",{"type":51,"tag":93,"props":793,"children":795},{"className":794},[],[796],{"type":57,"value":293},{"type":57,"value":798},", all within minutes\u002Fone interval",{"type":51,"tag":745,"props":800,"children":801},{},[802,804,809],{"type":57,"value":803},"A ",{"type":51,"tag":66,"props":805,"children":806},{},[807],{"type":57,"value":808},"flap",{"type":57,"value":810}," — usually a badly-tuned threshold, not an incident. Hygiene, not a P1.",{"type":51,"tag":723,"props":812,"children":813},{},[814,830],{"type":51,"tag":745,"props":815,"children":816},{},[817,822,823,828],{"type":51,"tag":93,"props":818,"children":820},{"className":819},[],[821],{"type":57,"value":597},{"type":57,"value":683},{"type":51,"tag":93,"props":824,"children":826},{"className":825},[],[827],{"type":57,"value":168},{"type":57,"value":829}," set + subscribed users",{"type":51,"tag":745,"props":831,"children":832},{},[833,835,840],{"type":57,"value":834},"The team was told. Lower value; surface only if material ",{"type":51,"tag":66,"props":836,"children":837},{},[838],{"type":57,"value":839},"and",{"type":57,"value":841}," still open\u002Funacted.",{"type":51,"tag":723,"props":843,"children":844},{},[845,854],{"type":51,"tag":745,"props":846,"children":847},{},[848],{"type":51,"tag":93,"props":849,"children":851},{"className":850},[],[852],{"type":57,"value":853},"notification_suppressed_by_agent=true",{"type":51,"tag":745,"props":855,"children":856},{},[857],{"type":57,"value":858},"Investigation agent judged it a false positive — verify before trusting; possible false negative.",{"type":51,"tag":723,"props":860,"children":861},{},[862,883],{"type":51,"tag":745,"props":863,"children":864},{},[865,867,873,875,881],{"type":57,"value":866},"Repeated ",{"type":51,"tag":93,"props":868,"children":870},{"className":869},[],[871],{"type":57,"value":872},"error",{"type":57,"value":874}," across consecutive checks (",{"type":51,"tag":93,"props":876,"children":878},{"className":877},[],[879],{"type":57,"value":880},"state=Errored",{"type":57,"value":882},")",{"type":51,"tag":745,"props":884,"children":885},{},[886],{"type":57,"value":887},"Alert is broken (bad query, deleted insight, missing series) — a silent blind spot.",{"type":51,"tag":60,"props":889,"children":890},{},[891,893,898,900,905,907,913],{"type":57,"value":892},"When in doubt about whether a breach is real, read the alert's ",{"type":51,"tag":93,"props":894,"children":896},{"className":895},[],[897],{"type":57,"value":497},{"type":57,"value":899},"\u002Fthreshold bounds and compare them against the firing check's ",{"type":51,"tag":93,"props":901,"children":903},{"className":902},[],[904],{"type":57,"value":214},{"type":57,"value":906},", and pull the insight with ",{"type":51,"tag":93,"props":908,"children":910},{"className":909},[],[911],{"type":57,"value":912},"insight-get",{"type":57,"value":914}," to understand what the metric is.",{"type":51,"tag":331,"props":916,"children":918},{"id":917},"save-memory-as-you-go",[919],{"type":57,"value":920},"Save memory as you go",{"type":51,"tag":60,"props":922,"children":923},{},[924,926,931],{"type":57,"value":925},"Write a scratchpad entry whenever a future run should change behavior. Encode the category in the key prefix; key per-alert entries on the ",{"type":51,"tag":66,"props":927,"children":928},{},[929],{"type":57,"value":930},"alert id",{"type":57,"value":932}," (stable across firings).",{"type":51,"tag":142,"props":934,"children":935},{},[936,946,957,968,986,1005],{"type":51,"tag":146,"props":937,"children":938},{},[939,944],{"type":51,"tag":93,"props":940,"children":942},{"className":941},[],[943],{"type":57,"value":316},{"type":57,"value":945}," — \"~{N} enabled alerts, ~{X} firing\u002Fday, mostly hourly; many owners. {timestamp}\"",{"type":51,"tag":146,"props":947,"children":948},{},[949,955],{"type":51,"tag":93,"props":950,"children":952},{"className":951},[],[953],{"type":57,"value":954},"dedupe:insight_alerts:{alert_id}",{"type":57,"value":956}," — \"Surfaced firing of '{name}' (alert {alert_id}, insight {short_id}) on {date}, value {v} vs bound {b}, silent. If still Firing next run, edit the report; if resolved + notified, treat as covered.\"",{"type":51,"tag":146,"props":958,"children":959},{},[960,966],{"type":51,"tag":93,"props":961,"children":963},{"className":962},[],[964],{"type":57,"value":965},"noise:insight_alerts:{alert_id}",{"type":57,"value":967}," — \"flaps every few hours on a too-tight bound; the firing itself isn't signal. Only surface as a one-off tuning hygiene finding, never per-flap.\"",{"type":51,"tag":146,"props":969,"children":970},{},[971,977,978,984],{"type":51,"tag":93,"props":972,"children":974},{"className":973},[],[975],{"type":57,"value":976},"addressed:insight_alerts:{alert_id}",{"type":57,"value":100},{"type":51,"tag":93,"props":979,"children":981},{"className":980},[],[982],{"type":57,"value":983},"allowlist:insight_alerts:{alert_id}",{"type":57,"value":985}," — team fixed \u002F acked it, or owner deliberately keeps it low-priority — skip.",{"type":51,"tag":146,"props":987,"children":988},{},[989,995,997,1003],{"type":51,"tag":93,"props":990,"children":992},{"className":991},[],[993],{"type":57,"value":994},"report:insight_alerts:{alert_id}",{"type":57,"value":996}," — the ",{"type":51,"tag":93,"props":998,"children":1000},{"className":999},[],[1001],{"type":57,"value":1002},"report_id",{"type":57,"value":1004}," of a report you filed for a firing on this alert, so the next run edits it (append_note with the fresh firing) instead of duplicating.",{"type":51,"tag":146,"props":1006,"children":1007},{},[1008,1014],{"type":51,"tag":93,"props":1009,"children":1011},{"className":1010},[],[1012],{"type":57,"value":1013},"reviewer:insight_alerts:{alert_id}",{"type":57,"value":1015}," — a resolved owner (bare lowercase GitHub login) for an alert or its insight, so reports route to a human faster.",{"type":51,"tag":331,"props":1017,"children":1019},{"id":1018},"decide",[1020],{"type":57,"value":1021},"Decide",{"type":51,"tag":60,"props":1023,"children":1024},{},[1025,1027,1032,1034,1039,1041,1047,1049,1055,1056,1062,1064,1070,1072,1078],{"type":57,"value":1026},"The generic report mechanics — search the inbox first (via the ",{"type":51,"tag":93,"props":1028,"children":1030},{"className":1029},[],[1031],{"type":57,"value":994},{"type":57,"value":1033}," pointer, else an ",{"type":51,"tag":93,"props":1035,"children":1037},{"className":1036},[],[1038],{"type":57,"value":515},{"type":57,"value":1040}," search on the specific alert \u002F insight name, not a broad word like ",{"type":51,"tag":93,"props":1042,"children":1044},{"className":1043},[],[1045],{"type":57,"value":1046},"alert",{"type":57,"value":1048},"), edit-vs-author, the status rules, reviewer routing, non-idempotent dedup, and the ",{"type":51,"tag":93,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":57,"value":1054},"priority",{"type":57,"value":100},{"type":51,"tag":93,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":57,"value":1061},"repository",{"type":57,"value":1063}," fields — live in the harness prompt and in ",{"type":51,"tag":93,"props":1065,"children":1067},{"className":1066},[],[1068],{"type":57,"value":1069},"authoring-scouts",{"type":57,"value":1071}," → ",{"type":51,"tag":93,"props":1073,"children":1075},{"className":1074},[],[1076],{"type":57,"value":1077},"references\u002Freport-contract.md",{"type":57,"value":1079},". Do not re-derive them here. Classify each candidate firing against prior runs and the scratchpad (net-new \u002F material-update \u002F already-covered \u002F addressed-or-noise), then apply only the insight-alerts judgment:",{"type":51,"tag":142,"props":1081,"children":1082},{},[1083,1108,1191,1201,1211],{"type":51,"tag":146,"props":1084,"children":1085},{},[1086,1091,1093,1099,1101,1106],{"type":51,"tag":66,"props":1087,"children":1088},{},[1089],{"type":57,"value":1090},"Edit",{"type":57,"value":1092}," when a still-live report already tracks the alert — a firing you surfaced that's still open, or a recurrence on the same alert. A persistent breach is one report across runs: ",{"type":51,"tag":93,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":57,"value":1098},"append_note",{"type":57,"value":1100}," the fresh firing (",{"type":51,"tag":93,"props":1102,"children":1104},{"className":1103},[],[1105],{"type":57,"value":214},{"type":57,"value":1107}," vs bound, the new fired-at, current notification status), not a fresh report per day.",{"type":51,"tag":146,"props":1109,"children":1110},{},[1111,1116,1118,1123,1125,1130,1132,1137,1139,1145,1147,1152,1154,1160,1162,1168,1170,1175,1177,1182,1184,1189],{"type":51,"tag":66,"props":1112,"children":1113},{},[1114],{"type":57,"value":1115},"Author",{"type":57,"value":1117}," when nothing live covers the firing. A report-worthy finding is an enabled, un-snoozed alert with a ",{"type":51,"tag":66,"props":1119,"children":1120},{},[1121],{"type":57,"value":1122},"material",{"type":57,"value":1124}," firing (well past its bound or a high anomaly score) inside the window that was ",{"type":51,"tag":66,"props":1126,"children":1127},{},[1128],{"type":57,"value":1129},"under-notified",{"type":57,"value":1131}," (silent \u002F suppressed) or is ",{"type":51,"tag":66,"props":1133,"children":1134},{},[1135],{"type":57,"value":1136},"still open and unacted",{"type":57,"value":1138},", with the alert id, insight ",{"type":51,"tag":93,"props":1140,"children":1142},{"className":1141},[],[1143],{"type":57,"value":1144},"short_id",{"type":57,"value":1146},", the firing ",{"type":51,"tag":93,"props":1148,"children":1150},{"className":1149},[],[1151],{"type":57,"value":214},{"type":57,"value":1153}," vs the threshold bound, the fired-at time, and the notification status in the ",{"type":51,"tag":93,"props":1155,"children":1157},{"className":1156},[],[1158],{"type":57,"value":1159},"evidence",{"type":57,"value":1161},". This is a triage callout, not a code fix → ",{"type":51,"tag":93,"props":1163,"children":1165},{"className":1164},[],[1166],{"type":57,"value":1167},"actionability=requires_human_input",{"type":57,"value":1169},". Priority: a material, silent firing on a clearly important metric is ",{"type":51,"tag":66,"props":1171,"children":1172},{},[1173],{"type":57,"value":1174},"P1",{"type":57,"value":1176},"; a material firing that was notified but is still open\u002Funacted is ",{"type":51,"tag":66,"props":1178,"children":1179},{},[1180],{"type":57,"value":1181},"P2",{"type":57,"value":1183},"; Errored-alert blind spots and flapping-threshold hygiene are ",{"type":51,"tag":66,"props":1185,"children":1186},{},[1187],{"type":57,"value":1188},"P3",{"type":57,"value":1190},".",{"type":51,"tag":146,"props":1192,"children":1193},{},[1194,1199],{"type":51,"tag":66,"props":1195,"children":1196},{},[1197],{"type":57,"value":1198},"Cap and rank.",{"type":57,"value":1200}," File at most ~5 reports per run, worst-first by the discriminator. If more cleared the bar, say how many you dropped in the close-out — never silently truncate. One digest-style report that bundles several minor firings is fine when none individually warrants its own entry; bundle the flapping\u002FErrored hygiene items this way rather than one report each.",{"type":51,"tag":146,"props":1202,"children":1203},{},[1204,1209],{"type":51,"tag":66,"props":1205,"children":1206},{},[1207],{"type":57,"value":1208},"Remember",{"type":57,"value":1210}," if it's suggestive but below the bar (a marginal breach, a single flap), or to refresh the baseline \u002F record what you ruled out.",{"type":51,"tag":146,"props":1212,"children":1213},{},[1214,1219,1221,1226,1227,1232,1233,1238,1239,1244],{"type":51,"tag":66,"props":1215,"children":1216},{},[1217],{"type":57,"value":1218},"Skip",{"type":57,"value":1220}," if a ",{"type":51,"tag":93,"props":1222,"children":1224},{"className":1223},[],[1225],{"type":57,"value":380},{"type":57,"value":100},{"type":51,"tag":93,"props":1228,"children":1230},{"className":1229},[],[1231],{"type":57,"value":388},{"type":57,"value":100},{"type":51,"tag":93,"props":1234,"children":1236},{"className":1235},[],[1237],{"type":57,"value":396},{"type":57,"value":100},{"type":51,"tag":93,"props":1240,"children":1242},{"className":1241},[],[1243],{"type":57,"value":372},{"type":57,"value":1245}," entry, or an existing inbox report, already covers it.",{"type":51,"tag":60,"props":1247,"children":1248},{},[1249,1251,1257,1259,1264,1266,1272,1274,1279,1281,1286],{"type":57,"value":1250},"Sibling courtesy: ",{"type":51,"tag":93,"props":1252,"children":1254},{"className":1253},[],[1255],{"type":57,"value":1256},"observability-gaps",{"type":57,"value":1258}," recommends ",{"type":51,"tag":127,"props":1260,"children":1261},{},[1262],{"type":57,"value":1263},"creating",{"type":57,"value":1265}," alerts and ",{"type":51,"tag":93,"props":1267,"children":1269},{"className":1268},[],[1270],{"type":57,"value":1271},"anomaly-detection",{"type":57,"value":1273}," scores the insights the team ",{"type":51,"tag":127,"props":1275,"children":1276},{},[1277],{"type":57,"value":1278},"views",{"type":57,"value":1280}," (whether or not they're alerted) — you own the firings of alerts that already exist. Honor their ",{"type":51,"tag":93,"props":1282,"children":1284},{"className":1283},[],[1285],{"type":57,"value":372},{"type":57,"value":1287}," entries; your unique angle is the missed-firing triage frame.",{"type":51,"tag":331,"props":1289,"children":1291},{"id":1290},"close-out",[1292],{"type":57,"value":1293},"Close out",{"type":51,"tag":60,"props":1295,"children":1296},{},[1297],{"type":57,"value":1298},"One paragraph: how many alerts you triaged, which reports you authored or edited (and why those), what you ruled out (flaps, snoozed, already-notified-and-resolved), and how many cleared the bar but were dropped for the per-run cap. The harness saves this as the run summary. \"Triaged the candidates, everything firing was already notified and acted on\" is a real outcome — do not write a separate run-metadata scratchpad entry.",{"type":51,"tag":254,"props":1300,"children":1302},{"id":1301},"disqualifiers-skip-these",[1303],{"type":57,"value":1304},"Disqualifiers (skip these)",{"type":51,"tag":142,"props":1306,"children":1307},{},[1308,1332,1356,1380,1396,1436],{"type":51,"tag":146,"props":1309,"children":1310},{},[1311,1316,1317,1322,1324,1330],{"type":51,"tag":66,"props":1312,"children":1313},{},[1314],{"type":57,"value":1315},"Snoozed or disabled alerts",{"type":57,"value":155},{"type":51,"tag":93,"props":1318,"children":1320},{"className":1319},[],[1321],{"type":57,"value":462},{"type":57,"value":1323}," in the future, or ",{"type":51,"tag":93,"props":1325,"children":1327},{"className":1326},[],[1328],{"type":57,"value":1329},"enabled=false",{"type":57,"value":1331},". The owner explicitly muted these; a firing on a snoozed alert is not a miss.",{"type":51,"tag":146,"props":1333,"children":1334},{},[1335,1340,1342,1347,1349,1354],{"type":51,"tag":66,"props":1336,"children":1337},{},[1338],{"type":57,"value":1339},"Flapping alerts",{"type":57,"value":1341}," — fire→resolve→fire within an interval with no sustained breach. That's a tuning problem, not an incident. At most ",{"type":51,"tag":66,"props":1343,"children":1344},{},[1345],{"type":57,"value":1346},"one",{"type":57,"value":1348}," hygiene finding (P3) suggesting the bound be retuned; record ",{"type":51,"tag":93,"props":1350,"children":1352},{"className":1351},[],[1353],{"type":57,"value":380},{"type":57,"value":1355}," and stop surfacing the individual flaps.",{"type":51,"tag":146,"props":1357,"children":1358},{},[1359,1364,1366,1371,1373,1378],{"type":51,"tag":66,"props":1360,"children":1361},{},[1362],{"type":57,"value":1363},"Already-notified-and-resolved",{"type":57,"value":1365}," — fired, the subscribed users were emailed\u002FSlacked (",{"type":51,"tag":93,"props":1367,"children":1369},{"className":1368},[],[1370],{"type":57,"value":168},{"type":57,"value":1372}," set), and it's back to ",{"type":51,"tag":93,"props":1374,"children":1376},{"className":1375},[],[1377],{"type":57,"value":293},{"type":57,"value":1379},". The team saw it and it's over; skip unless it's materially recurring across days.",{"type":51,"tag":146,"props":1381,"children":1382},{},[1383,1388,1389,1394],{"type":51,"tag":66,"props":1384,"children":1385},{},[1386],{"type":57,"value":1387},"Marginal breaches on low-count\u002Fnoisy series",{"type":57,"value":155},{"type":51,"tag":93,"props":1390,"children":1392},{"className":1391},[],[1393],{"type":57,"value":214},{"type":57,"value":1395}," sitting right on the bound, or a tiny absolute count. Below the materiality floor; remember, don't report.",{"type":51,"tag":146,"props":1397,"children":1398},{},[1399,1404,1406,1412,1414,1420,1421,1427,1428,1434],{"type":51,"tag":66,"props":1400,"children":1401},{},[1402],{"type":57,"value":1403},"Dev \u002F test \u002F internal-only alerts",{"type":57,"value":1405}," — alerts on insights whose ",{"type":51,"tag":93,"props":1407,"children":1409},{"className":1408},[],[1410],{"type":57,"value":1411},"$environment",{"type":57,"value":1413},"\u002Fservice is ",{"type":51,"tag":93,"props":1415,"children":1417},{"className":1416},[],[1418],{"type":57,"value":1419},"dev",{"type":57,"value":390},{"type":51,"tag":93,"props":1422,"children":1424},{"className":1423},[],[1425],{"type":57,"value":1426},"local",{"type":57,"value":390},{"type":51,"tag":93,"props":1429,"children":1431},{"className":1430},[],[1432],{"type":57,"value":1433},"test",{"type":57,"value":1435},", or a single owner's sandbox alert. Not user-facing.",{"type":51,"tag":146,"props":1437,"children":1438},{},[1439,1444,1446,1451],{"type":51,"tag":66,"props":1440,"children":1441},{},[1442],{"type":57,"value":1443},"Transient single-check errors",{"type":57,"value":1445}," — an alert that errored once and recovered. Only flag ",{"type":51,"tag":66,"props":1447,"children":1448},{},[1449],{"type":57,"value":1450},"persistent",{"type":57,"value":1452}," Errored state across consecutive checks.",{"type":51,"tag":60,"props":1454,"children":1455},{},[1456],{"type":57,"value":1457},"When in doubt, refresh memory instead of filing a report.",{"type":51,"tag":254,"props":1459,"children":1461},{"id":1460},"mcp-tools",[1462],{"type":57,"value":1463},"MCP tools",{"type":51,"tag":60,"props":1465,"children":1466},{},[1467],{"type":57,"value":1468},"Direct (read-only):",{"type":51,"tag":142,"props":1470,"children":1471},{},[1472,1482,1557],{"type":51,"tag":146,"props":1473,"children":1474},{},[1475,1480],{"type":51,"tag":93,"props":1476,"children":1478},{"className":1477},[],[1479],{"type":57,"value":270},{"type":57,"value":1481}," — the cheap triage layer over every alert (state, enabled, snoozed, last_notified\u002Fchecked, last_value, threshold\u002Fdetector). Your candidate funnel.",{"type":51,"tag":146,"props":1483,"children":1484},{},[1485,1490,1491,1497,1498,1504,1505,1511,1512,1518,1520,1525,1526,1531,1532,1537,1538,1543,1544,1549,1550,1555],{"type":51,"tag":93,"props":1486,"children":1488},{"className":1487},[],[1489],{"type":57,"value":681},{"type":57,"value":350},{"type":51,"tag":93,"props":1492,"children":1494},{"className":1493},[],[1495],{"type":57,"value":1496},"id",{"type":57,"value":358},{"type":51,"tag":93,"props":1499,"children":1501},{"className":1500},[],[1502],{"type":57,"value":1503},"checks_date_from",{"type":57,"value":358},{"type":51,"tag":93,"props":1506,"children":1508},{"className":1507},[],[1509],{"type":57,"value":1510},"checks_date_to",{"type":57,"value":358},{"type":51,"tag":93,"props":1513,"children":1515},{"className":1514},[],[1516],{"type":57,"value":1517},"checks_limit",{"type":57,"value":1519},") — the real firing history for one candidate: per-check ",{"type":51,"tag":93,"props":1521,"children":1523},{"className":1522},[],[1524],{"type":57,"value":448},{"type":57,"value":358},{"type":51,"tag":93,"props":1527,"children":1529},{"className":1528},[],[1530],{"type":57,"value":214},{"type":57,"value":358},{"type":51,"tag":93,"props":1533,"children":1535},{"className":1534},[],[1536],{"type":57,"value":176},{"type":57,"value":358},{"type":51,"tag":93,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":57,"value":168},{"type":57,"value":358},{"type":51,"tag":93,"props":1545,"children":1547},{"className":1546},[],[1548],{"type":57,"value":184},{"type":57,"value":358},{"type":51,"tag":93,"props":1551,"children":1553},{"className":1552},[],[1554],{"type":57,"value":872},{"type":57,"value":1556},", anomaly scores.",{"type":51,"tag":146,"props":1558,"children":1559},{},[1560,1565],{"type":51,"tag":93,"props":1561,"children":1563},{"className":1562},[],[1564],{"type":57,"value":912},{"type":57,"value":1566}," — what the alerted metric actually is (read when judging materiality).",{"type":51,"tag":60,"props":1568,"children":1569},{},[1570,1572,1577,1578,1583],{"type":57,"value":1571},"Inbox & reviewer routing (mechanics in ",{"type":51,"tag":93,"props":1573,"children":1575},{"className":1574},[],[1576],{"type":57,"value":1069},{"type":57,"value":1071},{"type":51,"tag":93,"props":1579,"children":1581},{"className":1580},[],[1582],{"type":57,"value":1077},{"type":57,"value":1584},"):",{"type":51,"tag":142,"props":1586,"children":1587},{},[1588,1604,1615],{"type":51,"tag":146,"props":1589,"children":1590},{},[1591,1596,1597,1602],{"type":51,"tag":93,"props":1592,"children":1594},{"className":1593},[],[1595],{"type":57,"value":515},{"type":57,"value":100},{"type":51,"tag":93,"props":1598,"children":1600},{"className":1599},[],[1601],{"type":57,"value":551},{"type":57,"value":1603}," — the reports already in the inbox; check before authoring so you edit instead of duplicating.",{"type":51,"tag":146,"props":1605,"children":1606},{},[1607,1613],{"type":51,"tag":93,"props":1608,"children":1610},{"className":1609},[],[1611],{"type":57,"value":1612},"inbox-report-artefacts-list",{"type":57,"value":1614}," — a comparable report's artefact log; reviewer precedent.",{"type":51,"tag":146,"props":1616,"children":1617},{},[1618,1624,1626,1632],{"type":51,"tag":93,"props":1619,"children":1621},{"className":1620},[],[1622],{"type":57,"value":1623},"scout-members-list",{"type":57,"value":1625}," — the in-run roster for routing ",{"type":51,"tag":93,"props":1627,"children":1629},{"className":1628},[],[1630],{"type":57,"value":1631},"suggested_reviewers",{"type":57,"value":1633}," to an alert \u002F insight owner.",{"type":51,"tag":60,"props":1635,"children":1636},{},[1637,1639,1645,1646,1651,1652,1657,1658,1664,1666,1671,1672,1677,1679,1685,1686,1692],{"type":57,"value":1638},"Harness-level: ",{"type":51,"tag":93,"props":1640,"children":1642},{"className":1641},[],[1643],{"type":57,"value":1644},"scout-project-profile-get",{"type":57,"value":358},{"type":51,"tag":93,"props":1647,"children":1649},{"className":1648},[],[1650],{"type":57,"value":348},{"type":57,"value":358},{"type":51,"tag":93,"props":1653,"children":1655},{"className":1654},[],[1656],{"type":57,"value":423},{"type":57,"value":358},{"type":51,"tag":93,"props":1659,"children":1661},{"className":1660},[],[1662],{"type":57,"value":1663},"scout-runs-retrieve",{"type":57,"value":1665}," (orientation + dedupe); ",{"type":51,"tag":93,"props":1667,"children":1669},{"className":1668},[],[1670],{"type":57,"value":98},{"type":57,"value":100},{"type":51,"tag":93,"props":1673,"children":1675},{"className":1674},[],[1676],{"type":57,"value":106},{"type":57,"value":1678}," (author \u002F edit a report — the report-channel contract is in the harness prompt); ",{"type":51,"tag":93,"props":1680,"children":1682},{"className":1681},[],[1683],{"type":57,"value":1684},"scout-scratchpad-remember",{"type":57,"value":358},{"type":51,"tag":93,"props":1687,"children":1689},{"className":1688},[],[1690],{"type":57,"value":1691},"scout-scratchpad-forget",{"type":57,"value":1693}," (memory).",{"type":51,"tag":254,"props":1695,"children":1697},{"id":1696},"when-to-stop",[1698],{"type":57,"value":1699},"When to stop",{"type":51,"tag":142,"props":1701,"children":1702},{},[1703,1708,1713],{"type":51,"tag":146,"props":1704,"children":1705},{},[1706],{"type":57,"value":1707},"No enabled alerts, or everything quiet → quick close-out.",{"type":51,"tag":146,"props":1709,"children":1710},{},[1711],{"type":57,"value":1712},"You've triaged the candidates and surfaced the worst few → close out, even if minor firings remain; the per-run cap is deliberate.",{"type":51,"tag":146,"props":1714,"children":1715},{},[1716,1718,1723,1724,1729,1730,1735,1736,1741],{"type":57,"value":1717},"A candidate matches a ",{"type":51,"tag":93,"props":1719,"children":1721},{"className":1720},[],[1722],{"type":57,"value":380},{"type":57,"value":100},{"type":51,"tag":93,"props":1725,"children":1727},{"className":1726},[],[1728],{"type":57,"value":388},{"type":57,"value":100},{"type":51,"tag":93,"props":1731,"children":1733},{"className":1732},[],[1734],{"type":57,"value":396},{"type":57,"value":100},{"type":51,"tag":93,"props":1737,"children":1739},{"className":1738},[],[1740],{"type":57,"value":372},{"type":57,"value":1742}," entry → skip.",{"type":51,"tag":60,"props":1744,"children":1745},{},[1746],{"type":57,"value":1747},"Fewer, well-calibrated findings that genuinely catch missed firings beat a daily re-list of every alert that happened to breach.",{"items":1749,"total":1864},[1750,1765,1783,1800,1814,1828,1846],{"slug":1751,"name":1751,"fn":1752,"description":1753,"org":1754,"tags":1755,"stars":23,"repoUrl":24,"updatedAt":1764},"analyzing-experiment-session-replays","analyze session replays for PostHog experiments","Analyze session replay patterns across experiment variants to understand user behavior differences. Use when the user wants to see how users interact with different experiment variants, identify usability issues, compare behavior patterns between control and test groups, or get qualitative insights to complement quantitative experiment results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1756,1757,1760,1761],{"name":21,"slug":22,"type":15},{"name":1758,"slug":1759,"type":15},"Design","design",{"name":9,"slug":8,"type":15},{"name":1762,"slug":1763,"type":15},"User Research","user-research","2026-04-06T18:44:38.291781",{"slug":1766,"name":1766,"fn":1767,"description":1768,"org":1769,"tags":1770,"stars":23,"repoUrl":24,"updatedAt":1782},"assessing-heatmaps","analyze page heatmaps and suggest improvements","Assesses what a page's heatmap is telling you and recommends concrete changes. Pulls click \u002F rageclick \u002F scroll-depth data for a URL, names the hot elements by cross-referencing autocapture events on the same page, and can create a saved heatmap the user opens in PostHog, then summarizes the behavior and proposes improvements.\nTRIGGER when: user asks what a heatmap shows, why people aren't clicking something, where users rage-click, how far they scroll, what to change on a page based on heatmap\u002Fclick data, or to 'analyze\u002Fassess\u002Freview the heatmap' for a URL.\nDO NOT TRIGGER when: the user only wants to create a saved heatmap screenshot with no analysis (use heatmaps-saved-create directly), or is asking about session replay in general (use investigating-replay).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1771,1772,1775,1776,1779],{"name":21,"slug":22,"type":15},{"name":1773,"slug":1774,"type":15},"Frontend","frontend",{"name":9,"slug":8,"type":15},{"name":1777,"slug":1778,"type":15},"Product Management","product-management",{"name":1780,"slug":1781,"type":15},"UX Design","ux-design","2026-06-05T07:40:43.37798",{"slug":1784,"name":1784,"fn":1785,"description":1786,"org":1787,"tags":1788,"stars":23,"repoUrl":24,"updatedAt":1799},"auditing-experiments-flags","audit PostHog experiments and feature flags","Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1789,1792,1795,1796],{"name":1790,"slug":1791,"type":15},"Audit","audit",{"name":1793,"slug":1794,"type":15},"Feature Flags","feature-flags",{"name":9,"slug":8,"type":15},{"name":1797,"slug":1798,"type":15},"QA","qa","2026-04-06T18:44:30.657553",{"slug":1069,"name":1069,"fn":1801,"description":1802,"org":1803,"tags":1804,"stars":23,"repoUrl":24,"updatedAt":1813},"author and edit PostHog Signals scouts","How to author, edit, and adapt PostHog Signals scouts — the scheduled agents that scan a project and write reports into the Signals inbox. Use when a user wants to customize a canonical scout for their own setup (narrow its scope, retune its thresholds, add disqualifiers), tweak a scout's schedule or dry-run posture, or write a brand-new scout from scratch for a specific use case (a custom event, a product surface no canonical scout covers), or steer a scout without editing it at all by leaving it a note. Covers the scout SKILL.md anatomy, the report contract, the dedupe + scratchpad-memory conventions, the scout-notes steering channel, the per-team skills-store path vs the canonical in-repo path, and the write-and-inspect test loop (with dry-run as an optional safety net). Trigger on \"write\u002Fedit\u002Fcustomize a signals scout\", \"new scout for X\", \"tune my scout schedule\", \"make a scout that watches \u003Cevent>\", \"leave a note for \u002F give feedback to a scout\", \"tell the scouts about X\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1805,1808,1811,1812],{"name":1806,"slug":1807,"type":15},"Agents","agents",{"name":1809,"slug":1810,"type":15},"Automation","automation",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-28T05:33:45.509154",{"slug":1815,"name":1815,"fn":1816,"description":1817,"org":1818,"tags":1819,"stars":23,"repoUrl":24,"updatedAt":1827},"building-a-dashboard","build and update PostHog dashboards","Build a new dashboard, or update an existing one, from a set of insights — the same job the in-app assistant does with its upsert-dashboard tool, but over MCP. Use when a user asks to create a dashboard, put several metrics\u002Fcharts together on one page, assemble a dashboard for a topic (product analytics, retention, revenue, activation, etc.), or add\u002Fremove\u002Freplace insights on a dashboard they already have. Covers deciding create vs update, reusing existing insights vs creating new ones, and using PostHog's vetted dashboard templates as reference for what a strong dashboard on a topic looks like.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1820,1821,1824],{"name":21,"slug":22,"type":15},{"name":1822,"slug":1823,"type":15},"Dashboards","dashboards",{"name":1825,"slug":1826,"type":15},"MCP","mcp","2026-07-21T06:07:38.060598",{"slug":1829,"name":1829,"fn":1830,"description":1831,"org":1832,"tags":1833,"stars":23,"repoUrl":24,"updatedAt":1845},"checking-deploy-timing","correlate PostHog deployments with GitHub commits","Determine when a PostHog code change reached a given environment by reading the hidden GIT deploy annotations in the project and correlating them with the merge commit on GitHub. Use when PostHog staff ask \"when was X deployed\", \"is my change live in the US\u002FEU yet\", \"has my PR shipped\", \"did the fix roll out to prod-us\", or otherwise want to know whether\u002Fwhen a commit, PR, or feature went out to a region. Do not answer deploy-timing questions from event\u002Fdata volume alone — that only shows when data changed, not when code shipped.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1834,1837,1840,1843,1844],{"name":1835,"slug":1836,"type":15},"Deployment","deployment",{"name":1838,"slug":1839,"type":15},"Git","git",{"name":1841,"slug":1842,"type":15},"GitHub","github",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-28T07:46:59.53536",{"slug":1847,"name":1847,"fn":1848,"description":1849,"org":1850,"tags":1851,"stars":23,"repoUrl":24,"updatedAt":1863},"choosing-trend-or-slope-view","visualize trends and growth over time","Clarify how to visualize change over a time range before building a trend. Use whenever the user asks how much something changed, grew, dropped, improved, or regressed between two points or periods — \"how much did X change from A to B\", \"before vs after\", \"start vs end\", \"week over week\", \"compare this month to last\", \"change over time\" — or mentions a \"slope chart\" \u002F \"slopegraph\". Two readings of \"change\" need different charts: the whole trend (a line, every interval) versus just the two endpoints (a slope, start vs end). Ask which they want, then render it. Not for choosing a saved insight ChartDisplayType in the insight editor.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1852,1853,1856,1859,1860],{"name":21,"slug":22,"type":15},{"name":1854,"slug":1855,"type":15},"Charts","charts",{"name":1857,"slug":1858,"type":15},"Data Visualization","data-visualization",{"name":9,"slug":8,"type":15},{"name":1861,"slug":1862,"type":15},"Reporting","reporting","2026-06-18T08:18:57.960157",56,{"items":1866,"total":2023},[1867,1882,1892,1905,1918,1931,1947,1960,1972,1987,1997,2013],{"slug":1868,"name":1868,"fn":1869,"description":1870,"org":1871,"tags":1872,"stars":1879,"repoUrl":1880,"updatedAt":1881},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1873,1874,1877,1878],{"name":21,"slug":22,"type":15},{"name":1875,"slug":1876,"type":15},"Cost Optimization","cost-optimization",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-07-28T05:34:11.117757",{"slug":1883,"name":1883,"fn":1884,"description":1885,"org":1886,"tags":1887,"stars":1879,"repoUrl":1880,"updatedAt":1891},"auditing-endpoints","audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1888,1889,1890],{"name":21,"slug":22,"type":15},{"name":1790,"slug":1791,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":1893,"name":1893,"fn":1894,"description":1895,"org":1896,"tags":1897,"stars":1879,"repoUrl":1880,"updatedAt":1904},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1898,1899,1902,1903],{"name":1790,"slug":1791,"type":15},{"name":1900,"slug":1901,"type":15},"Data Warehouse","data-warehouse",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":1906,"name":1906,"fn":1907,"description":1908,"org":1909,"tags":1910,"stars":1879,"repoUrl":1880,"updatedAt":1917},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1911,1912,1913,1916],{"name":1790,"slug":1791,"type":15},{"name":1900,"slug":1901,"type":15},{"name":1914,"slug":1915,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":1919,"name":1919,"fn":1920,"description":1921,"org":1922,"tags":1923,"stars":1879,"repoUrl":1880,"updatedAt":1930},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1924,1925,1928,1929],{"name":17,"slug":18,"type":15},{"name":1926,"slug":1927,"type":15},"Debugging","debugging",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":1932,"name":1932,"fn":1933,"description":1934,"org":1935,"tags":1936,"stars":1879,"repoUrl":1880,"updatedAt":1946},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1937,1938,1941,1942,1945],{"name":21,"slug":22,"type":15},{"name":1939,"slug":1940,"type":15},"Monitoring","monitoring",{"name":13,"slug":14,"type":15},{"name":1943,"slug":1944,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},"2026-07-18T05:10:54.430898",{"slug":1948,"name":1948,"fn":1949,"description":1950,"org":1951,"tags":1952,"stars":1879,"repoUrl":1880,"updatedAt":1959},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1953,1954,1955,1956],{"name":1809,"slug":1810,"type":15},{"name":1825,"slug":1826,"type":15},{"name":9,"slug":8,"type":15},{"name":1957,"slug":1958,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":1961,"name":1961,"fn":1962,"description":1963,"org":1964,"tags":1965,"stars":1879,"repoUrl":1880,"updatedAt":1971},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1966,1967,1968,1969,1970],{"name":21,"slug":22,"type":15},{"name":1926,"slug":1927,"type":15},{"name":1773,"slug":1774,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":1973,"name":1973,"fn":1974,"description":1975,"org":1976,"tags":1977,"stars":1879,"repoUrl":1880,"updatedAt":1986},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1978,1981,1982,1983],{"name":1979,"slug":1980,"type":15},"API Development","api-development",{"name":1773,"slug":1774,"type":15},{"name":9,"slug":8,"type":15},{"name":1984,"slug":1985,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":1988,"name":1988,"fn":1989,"description":1990,"org":1991,"tags":1992,"stars":1879,"repoUrl":1880,"updatedAt":1996},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1993,1994,1995],{"name":1979,"slug":1980,"type":15},{"name":1943,"slug":1944,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":1998,"name":1998,"fn":1999,"description":2000,"org":2001,"tags":2002,"stars":1879,"repoUrl":1880,"updatedAt":2012},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2003,2004,2007,2008,2009],{"name":1809,"slug":1810,"type":15},{"name":2005,"slug":2006,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":1861,"slug":1862,"type":15},{"name":2010,"slug":2011,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":2014,"name":2014,"fn":2015,"description":2016,"org":2017,"tags":2018,"stars":1879,"repoUrl":1880,"updatedAt":2022},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2019,2020,2021],{"name":21,"slug":22,"type":15},{"name":1979,"slug":1980,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231]