incident-slo-runbook
Create or audit SLOs, SLIs, alert rules, incident response steps, escalation paths, postmortems, operational runbooks, and customer-impact communication. Use when defining production reliability, preparing launch readiness, responding to an outage, writing a runbook, tuning alerts, or closing the loop after an incident.
git clone --depth 1 https://github.com/majiayu000/spellbook /tmp/incident-slo-runbook && cp -r /tmp/incident-slo-runbook/skills/incident-slo-runbook ~/.claude/skills/incident-slo-runbookSKILL.md
# Incident SLO Runbook ## Purpose Use this skill to connect observability to action. Metrics and logs are not enough; each critical user journey needs an SLO, alert, owner, response path, and post-incident learning loop. ## SLO Design Define: 1. User journey or system capability. 2. SLI: request success, latency, freshness, durability, or job completion. 3. SLO target and measurement window. 4. Error budget and burn-rate alerts. 5. Exclusions with rationale. 6. Dashboard and data source. 7. Owner and escalation path. Avoid vanity metrics. Prefer user-visible success and latency over internal counters unless internal counters are the only reliable proxy. ## Runbook Requirements Each runbook should include: - Symptom and alert name. - Impacted users or systems. - First 5-minute checks. - Triage decision tree. - Mitigation steps with commands. - Rollback or failover path. - Escalation owner. - Customer/support communication note. - Postmortem trigger. Commands must be safe to run or explicitly labeled destructive. ## Incident Flow 1. Declare severity and incident commander. 2. Confirm impact from live evidence. 3. Stabilize with the lowest-risk mitigation. 4. Communicate status on a fixed cadence. 5. Preserve evidence before cleanup. 6. Write a blameless postmortem with action items and owners. ## Output Shape ```text service_or_journey: slo: alerts: dashboard_or_queries: runbook: escalation: postmortem_template: verification: ```
Audit AND optimize a CLAUDE.md / AGENTS.md instruction file — score it against the five high-leverage patterns, flag anti-patterns, then apply approved fixes in place. Use when the user says 优化 CLAUDE.md / 优化 AGENTS.md / optimize my agent doc / 帮我改 claudemd, or after an audit when they want the fixes applied (not just reported).
Generate or update repository-specific AGENTS.md instruction files from real repo evidence. Use when asked to create, design, scaffold, split, or improve root or scoped AGENTS.md files for Codex/Claude/agent workflows, especially when a repo needs directory-specific rules, validation commands, generated-file boundaries, or a short agent onboarding router.
REST/GraphQL/gRPC API design best practices. Use when designing APIs, defining contracts, handling versioning. Covers OpenAPI 3.2, GraphQL Federation, gRPC streaming.
Mobile app UI design expert for iOS and Android. Use when designing app interfaces, creating design systems, ensuring accessibility, or following platform guidelines. Covers Material Design 3, Human Interface Guidelines, color theory, typography, and 2025 trends.
End-to-end app feature inventory and user-story testing workflow with a canonical tracker. Use when the user asks to audit every feature, derive expected behavior from code, test user journeys, or explicitly fix and retest documented UX or logistical defects.
Design architecture foundations before implementation. Use when asked to design or refactor architecture, choose Rust/Go crate, package, module, runtime, workflow, or service boundaries, compare mature project architecture, prevent stacked one-off PRs, audit migration debt in existing repos, or produce a spec before coding.
Evidence-driven architecture research for understanding real systems and making technical decisions. Use when doing architecture landscape studies, source-backed system archaeology, build-vs-buy or adopt/adapt/build decisions, open-source and commercial comparisons, revisiting an earlier architecture choice, or handling requests such as 架构调研, 架构选型, 竞品架构, 技术尽调, 同类方案, 开源替代, how is X built, and what should we learn from X. Do not use for small mechanical changes, market-only discovery, or detailed design after the technology direction is already fixed.
Ask Grok or Gemini via opencli (browser-session based, no API cost). Use when the user says "问 grok", "问 gemini", "ask grok", "ask gemini", "用 grok 查", "grok 怎么看", "让 gemini 分析", or wants a second opinion from Grok/Gemini without paying API tokens. Routes to opencli which drives the already-logged-in Chrome session.