Turn an observed condition into an executable, replay-tested diagnostic rule.
Read rules, data semantics and
compatibility. Use tools for replay.
Establish the condition and select representative normal and incident data. Resolve
this skill's absolute directory before invoking scripts/phargus.mjs.
Prefer collector alert JSON for a single metric threshold. Choose comparison and
forWindows deliberately, with thresholds in the metric's native units.
Use a sandbox .js function body for multi-metric/trend logic. Return findings with
windowStart and message; the host must not evaluate or import rule text.
Run rules on normal and incident data. Inspect equality boundaries, sustained-window
behavior, firing/resolved transitions and false alarms. Explain any input gaps.
Treat missing isolated-vm or ok: false as execution failures. Close runners and provide
the actual collector/plugin activation recipe after replay passes.
Return the rule files, threshold rationale, both replay results and activation steps.
Avoid describing a heuristic finding (such as rising heap) as proof of a root cause.
Example request: "Alert when event-loop delay exceeds 50 ms for three windows without flagging this normal recording."