Use when a task involves Tsuga CLI commands, TQL log or trace search, aggregation bodies, metric temporality math, resource lookup or CRUD planning, service ownership, reliability posture, quality reports, monitor or dashboard context, notification rules, retention/tag policies, ingestion keys, docs lookup, command help, skeleton payloads, or Tsuga app deep links.
Use when asked to create, update, validate, delete, or review a Tsuga dashboard; add or fix widgets; correct layout; build a monitoring view for a service, team, system, SLO, capacity, latency, throughput, or error-rate question; verify dashboard payloads, widget queries, graph schemas, normalizers, formulas, table grouping, time presets, or layout rules.
One-shot procedure for turning a live Tsuga account + codebase list + ambient docs into the `skills/knowledge-company/` tree: top-level COMPANY_GENERAL_KNOWLEDGE.md + COMPANY_TELEMETRY_KNOWLEDGE.md, per-team TEAM_KNOWLEDGE.md, per-service SERVICE_KNOWLEDGE.md dossiers with ready-to-run `tsuga` CLI queries. Trigger this skill when bootstrapping knowledge-company from scratch for a new customer / company, refreshing it after a major service taxonomy change, or after a CLI rename that invalidates the existing ready-to-run commands. Inputs: Tsuga MCP / CLI access, list of GitHub codebases, optional `inputs/raw-docs/` for architecture notes. Outputs: populated `skills/knowledge-company/` ready for the runtime agent to load.
Primary entry point for active-incident investigation, post-incident RCA, or recurring-degradation triage. Use when a monitor fires, a customer reports slow / errored / missing telemetry, an incident is declared (P1–P5), or someone asks 'what's wrong with X right now?'. Coordinates parallel evidence branches — telemetry sweep (`tsuga` CLI), change correlation (git / gh), analogue search, codebase-grep, challenger review — tracking hypotheses behind evidence gates, and produces an operator-ready verdict with cited evidence plus two durable deliverables by default: a Tsuga investigation record and a proofs dashboard.
Use when choosing an OpenTelemetry signal, instrument, or telemetry name: metric vs span vs log, counter vs histogram vs gauge, span event vs child span, resource/span/log/metric attribute naming, semantic convention checks, deployment.environment migration, bounded dimensions, cardinality estimates, high-cardinality risk, or whether an observation belongs in traces, metrics, logs, or resource attributes.
One-shot procedure for turning a raw incident dump (Slack threads, incident reports, GitHub PRs, Tsuga CLI output) into a populated `skills/incident-history/references/incidents/` archive with one folder per incident, each containing a SUMMARY.md with a validated `## Diagnostic path` section. Trigger this skill when bootstrapping `incident-history` from scratch for a new deployment, refreshing an existing archive with new incidents, or reformatting an incident tracker's export into the shape your investigation runtime expects. Inputs: `inputs/incidents/<INC-id>/` directories holding raw material per incident. Outputs: `skills/incident-history/references/incidents/<INC-id>/SUMMARY.md` + `_inventory.csv`.
Use when linting Tsuga skill bundles after editing runtime skills, generated incident-history or knowledge-company archives, or skill references; use when checking frontmatter, SKILL.md length, forbidden Tsuga CLI patterns, cross-links, required sections, generated dossier structure, sampled read-only command shape, local reference validation, release readiness, or whether a skill tree is ready for review.
Use when asked about slow requests, high latency, latency spikes, p95 or p99 trace duration, slow spans, top slow operations, peak latency windows, sustained vs transient latency degradation, trace-log correlation, span count by operation, downstream latency suspicion, which operations are slow for a specific service, or whether latency correlates with errors.