Menu
Use when classifying a monitoring result, deciding whether to escalate, or preparing a Watchdog Alert.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | classify-severity-and-escalate |
| description | Use when classifying a monitoring result, deciding whether to escalate, or preparing a Watchdog Alert. |
Use when deciding whether to log, wait, or escalate.
| Level | Criteria | Action |
|---|---|---|
| info | Observation only; no user impact, no baseline deviation | Log only. Do not message main. |
| warning | Deviation from baseline, partial degradation, or budget posture approaching a configured ceiling while the system is still functional | Log. Escalate to main only if it persists for 2 consecutive checks at least 10 minutes apart. |
| critical | Service unreachable, data-loss risk, or security concern | Escalate immediately after confirmation from at least one independent signal. |
Do not use sessions_send or sessions_list from cron context unless the cron prompt explicitly instructs you to do so.
From cron:
/Projects/... as remote paths## Watchdog Alert
**System:** <service or system>
**Severity:** <info | warning | critical>
**Detected:** <timestamp>
### Observation
<facts only>
### Baseline comparison
<comparison to known baseline or note that none exists>
### Recommended action
<what should happen next and who should own it>
Use for Gitea, GitOps, registry, and every non-trivial implementation task that should be delegated to Codex instead of being coded inline.
Use for non-trivial implementation work. Delegate the coding or large-repo analysis to Codex CLI, then record usage before handing back results.
Browse in-cluster Gitea repos, issues, pull requests, commits, chart values, GitOps definitions, and sandbox image sources for read-only design context with the `__REVIEWER_GITEA_USERNAME__` Gitea user shared with auditor.
Review in-cluster Gitea repos and pull requests by reading files, inspecting diffs, checking comments, posting review feedback, and approving with the `__REVIEWER_GITEA_USERNAME__` Gitea user shared with architect; merge only with explicit instruction.
Use this to turn recent Qdrant memories and changed Nextcloud docs into clean Memgraph links, Qdrant graph-link annotations, and an updated grooming checkpoint.
Use when routing work to a standing specialist or reviewing a specialist return.