Menu
Observability discipline — structured logs, correlation, metrics, actionable alerts. Load when adding logging, metrics or diagnosing production behavior.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Context engineering — memory navigation, textual graph traversal, progressive disclosure, recovery. Load when assembling context for a task or when lost.
Implementation-side security discipline — headers, dependencies, secrets, authz. Load for hardening work (sec-ops domain).
Commit conventions, branching, anchors in messages, and the git safety rules. Load for any git operation beyond status/diff.
Anti-generic-AI design discipline — bans, tells, and the slop test. Load for ANY new UI surface or visual redesign. Inspired by Impeccable (Apache 2.0).
Motion & animation discipline — purpose, performance, reduced-motion. Load when work involves animation, transitions or scroll effects.
Microcopy discipline — buttons, errors, empty/loading/success states, alt text. Voice and tone come from the project's memory, not from this skill.
| name | observability |
| description | Observability discipline — structured logs, correlation, metrics, actionable alerts. Load when adding logging, metrics or diagnosing production behavior. |
Stack tooling from memory-long §stack; the discipline is universal: if you can't explain what the system did from its telemetry, you don't have observability — you have vibes.
error = human must act · warn = degraded but handled · info = state change worth auditing · debug = off in prod by default.data-safety), secrets/tokens, full request bodies. Log the shape of a failure (ids, codes, counts), not the payload.Per endpoint/consumer: Rate, Errors, Duration (p50/p95/p99 — averages lie). Plus queue depth/age for async work and business counters that matter to the PRD (signups, orders — the metrics the humans actually watch).
Actionable or nonexistent: every alert names its runbook/next action; alerts nobody acts on get deleted, not muted. Alert on symptoms (user-facing error rate, latency), not causes (CPU%) — causes go on dashboards. Page thresholds = sustained breach, not single spikes.
New endpoint/job ships with: correlation propagated, RED visible, failure path emits the right level. Report includes "how we'll know it's broken in prod" — a feature without that sentence isn't done.