scoutflo

Non-scored alert noise & fatigue assessment with TWO modes. (1) Cross-audit roll-up — aggregates the alerting-noise findings the individual audits already produced, finds services paged by more than one tool for one incident (cross-source storm), and computes the alert-to-incident ratio when an incident-count block is supplied. (2) Standalone — point it at a single alerting integration (even with no full audit run) and it drives that provider's own alerting-lane checks to produce a config + fire-history noise picture directly. Runs inside /scoutflo:audit-all after correlation, or standalone. Never re-scores a finding, cites source finding-IDs, never fabricates a number.

Read-only proof that the paging path works and is not drowning in noise; follows each alert rule through Alertmanager routes to a live receiver, scores delivery gaps, and scores alert-hygiene gaps (flapping, permanently-firing rules, missing `for` debounce, missing grouping or inhibition, duplicate delivery, resolve-noise) as findings. Use when the user asks whether alerts reach a human, or mentions the Prometheus/Alertmanager paging path, silent alerts, missed pages, dead receivers, routing trees, mute timings, notification delivery, alert noise, alert fatigue, flapping alerts, or noisy paging. Do not use for a full metrics/logs/traces audit (use audit-lgtm), for rule presence, rule-evaluation health, or the Prometheus server plane (use audit-prometheus), Grafana-managed alerting (use audit-grafana), error-tracker depth (use audit-sentry), or to change routing (use setup-lgtm or setup-grafana).

Runs every audit configured in toolkit.yaml and writes one combined summary with per-target scores, estate sizes, score trends from each history ledger, and blocked audits, plus a single combined Slack brief. Use when the user asks to audit everything, run all audits, check overall observability health, or wants one combined report or brief across stacks. Do not use for a single stack (run its audit directly, such as audit-grafana) or to fix findings (use a setup-* skill).

Read-only scored audit of AWS observability (CloudWatch alarms, SNS routing, EC2/ECS/EKS/Lambda compute health, RDS/Aurora/DocumentDB, Route53/ELB uptime, log forwarding) that also reports a separate non-scored Cost & Resource Optimization section from Compute Optimizer, Cost Explorer, and Trusted Advisor; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring AWS observability, CloudWatch alarms, SNS alert delivery, managed-database resilience or backups, or AWS cost/rightsizing findings. Do not use for Alertmanager routing proof on a self-hosted stack (use audit-alertmanager), for in-cluster LGTM or Grafana on EKS (use audit-lgtm or audit-grafana), or to change AWS resources (use setup-aws).

Read-only scored audit of Azure Monitor observability, covering action groups and alert delivery, metric alerts, scheduled-query (log) alerts, activity-log alerts, VM/VMSS coverage, AKS Container Insights and managed Prometheus, Log Analytics coverage and retention, and App Gateway/Load Balancer diagnostics; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring Azure or Azure Monitor alerting, action groups, metric or log alerts, AKS monitoring add-ons, Log Analytics retention, or noisy Azure alerts. Do not use to change Azure resources (use setup-azure), for in-cluster Prometheus stacks on AKS (use audit-lgtm), or for Kubernetes-workload RBAC (use audit-kubernetes).

Read-only DEEP, per-resource cloud cost audit across AWS, GCP, Azure, Kubernetes, Datadog, and DigitalOcean; queries each provider's own cost-recommendation surfaces live (AWS Compute Optimizer / Cost Explorer / Cost Optimization Hub, GCP Recommender, Azure Cost Management + Advisor, Datadog usage, Kubernetes requests-vs-usage, DigitalOcean billing), ranks opportunities by provider-native dollar savings, and writes a ranked-savings findings.json (scoutflo-cost/v1) + report.md. It never invents a dollar figure and never mutates anything. Use when the user asks for a cost audit, cost optimization, rightsizing, idle/unattached/over-provisioned resources, commitment (RI/SP/CUD) coverage, or "where am I wasting money". Do not use to change resources (each finding is report-only), for reliability/alerting scoring (use audit-aws/audit-gcp/etc), or to re-aggregate prior findings (this queries providers live; prior audit cost findings are cross-reference only).

Read-only scored audit of Datadog monitor health across notification delivery, monitor noise controls (recovery thresholds, no-data, renotify, auto-resolve), muting and downtimes, SLO and composite coverage, plus a separate non-scored Cost & Resource Optimization section from Datadog's own usage endpoints; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring Datadog, Datadog monitors, monitor noise or flapping, muted or downtimed monitors, dead notification handles, SLO alerting, or Datadog custom-metric cost. Do not use to change Datadog (no setup-datadog ships yet; the audit names each fix), for Datadog data shown in Grafana (use audit-grafana), or for the paging layer downstream of a monitor (use audit-pagerduty).

Read-only scored audit of DigitalOcean observability across App Platform apps, managed databases, uptime checks, alert policies, Slack and email routing, and log forwarding; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring DigitalOcean, doctl, App Platform alerts or health checks, managed database alert policies, or DO uptime checks. Do not use to change DO resources (use setup-digitalocean), for DOKS cluster telemetry (use audit-lgtm), or for Grafana or Sentry (use audit-grafana, audit-sentry).

Read-only scored audit of Kibana Alerting across rule notification delivery, dead connectors, rule execution health (error/warning states), alert noise controls (flapping detection, alert_delay, action throttling, snoozes), and rule-type coverage per Kibana space; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring ELK, Elastic, Kibana alerting, Kibana rules, Watcher, dead Kibana connectors, flapping rules, or snoozed rules. Do not use to change Kibana (no setup-elk ships yet; the audit names each fix), for Elasticsearch cluster or index health, or for Grafana-rendered Elastic data (use audit-grafana).

Read-only scored audit of Google Cloud observability, covering Cloud Monitoring alert policies, notification channels, uptime checks, dashboards, logs-based metrics and sinks, GKE telemetry settings, Compute Engine VM metrics, and load balancer health wiring; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring GCP or Google Cloud monitoring and alerting, Cloud Monitoring, uptime checks, Ops Agent coverage, or noisy GCP alerts. Do not use to change GCP resources (use setup-gcp), for in-cluster Prometheus stacks on GKE (use audit-lgtm), or for DigitalOcean (use audit-digitalocean).

Read-only scored audit of the Grafana application layer: datasource health and credentials, dashboard panel semantics (scope-leak and stale-datasource checks), alert rule wiring and receiver delivery, query hygiene, usage and cost visibility; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring Grafana, Grafana dashboards, Grafana alert rules, contact points, notification policies, or panel queries. Do not use for Loki, Tempo, Mimir, or VictoriaMetrics backend health (use audit-lgtm), for proving a page reaches a human (use audit-alertmanager), for Sentry (use audit-sentry), for DigitalOcean (use audit-digitalocean), or for Google Cloud (use audit-gcp).

Read-only scored audit of groundcover monitors and alerting hygiene across per-monitor firing controls (pendingFor, hysteresis resolve threshold, auto-resolve, no-data and execution-error state), notification noise (re-notification interval, status filters, route-bypass), monitor health and silence hygiene, and destination liveness via workflows; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring groundcover, groundcover monitors, groundcover alerts, flapping or no-data groundcover monitors, groundcover notification routes, or groundcover silences. Do not use to change groundcover (no setup-groundcover ships yet; the audit names each fix), or for the underlying metrics/traces/logs data groundcover queries (audit the monitors, not the telemetry).

Read-only scored audit of Jira Service Management (JSM) Operations paging health across escalation and routing, on-call schedules, notification-policy noise controls (dedup, delay, suppress, auto-close, auto-restart), maintenance windows, heartbeat liveness, and unacknowledged-alert aging; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring JSM Operations, Opsgenie, Atlassian on-call, escalation or routing rules, alert notification policies, dead heartbeats, snoozed or suppressed alerts, or unacked JSM alerts. Do not use to change JSM (no setup-jsm ships yet; the audit names each fix), for Jira issues or service-desk request queues (this is the Operations/alerting side), or for the monitoring tools that send events to JSM (use their own audits).

Read-only scored audit of a New Relic account across alert delivery (condition to policy to workflow to destination), alert noise (tiering, evaluation sanity, muting hygiene, measured fire-history from NrAiIncident), entity coverage and span-derived topology, SLO and dashboard posture, and data health (NrIntegrationError, cardinality, ingest concentration), plus a separate non-scored ingest and cost section; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring New Relic, NR alerts or alert policies, NRQL conditions, workflows and notification destinations, muting rules, New Relic entity or service coverage, NrAiIncident noise, or New Relic ingest volume. Do not use to change New Relic (use setup-newrelic; this audit only names each fix), for OTel collector configuration on the shipping side (that is the cluster's own config), or for the paging layer downstream of a notification (use audit-pagerduty or audit-zenduty).

Read-only scored audit of PagerDuty paging health across services, escalation policies, on-call schedules, alert grouping and noise controls, incident aging, and a vendor-analytics-backed actionability section (auto-resolved share, MTTA, sleep-hour interruptions); writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring PagerDuty, escalation policies, on-call coverage or schedule gaps, alert grouping, unacknowledged incidents, pages nobody takes, or PagerDuty noise. Do not use to change PagerDuty (no setup-pagerduty ships yet; the audit names each fix), for Alertmanager routing (use audit-alertmanager), or for monitoring-tool alert rules (use audit-lgtm, audit-grafana, audit-sentry).

Read-only scored audit of your Sentry org: project privacy scrubbing, alert rule tiers and receiver liveness, integrations, releases and source maps, and cron/uptime monitors; writes findings.json and report.md, changes nothing. Use when the user mentions auditing or scoring Sentry, Sentry alert rules or receivers, privacy scrubbing or PII, source maps, release health, or cron/uptime monitors, or asks whether Sentry paging actually works. Do not use for Sentry data in Grafana dashboards (use audit-grafana), for metrics/logs/traces backends (use audit-lgtm), for the Alertmanager paging path (use audit-alertmanager), or to change anything (use setup-sentry).

Read-only scored audit of Zenduty (Xurrent IMR) paging health across escalation and on-call, alert-rule and service-level noise controls (collation dedup, suppress rules, correlation, delay, maintenance windows), integration and routing hygiene, and a server-side-analytics-backed actionability section (MTTA, MTTR, acked and resolved share); writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring Zenduty or Xurrent IMR, escalation policies, on-call gaps, alert rules or suppress rules, alert collation or correlation, dead Zenduty integrations, global alert routing, or unacknowledged Zenduty incidents. Do not use to change Zenduty (no setup-zenduty ships yet; the audit names each fix), or for the monitoring tools that send events to Zenduty (use their own audits).

Capture your organization's SRE guardrails as a rich, version-controlled source-of-truth file (~/.scoutflo/business_context.md) that every audit and setup reads — SLAs and SLOs per service, per-environment access (which AWS profile / GCP project / cluster each environment uses) and per-environment SLA, critical services that need approval before any change, exclusions (regions/accounts/services/resources to never touch), risky operations to block, cost sensitivity, token budgets, notification routing, and free-form custom rules and runbooks. Captures interactively (guided questions, paste-your-own, or import an existing file). Use when the user wants to set business context, guardrails, per-service or per-environment SLAs, critical-service approval gates, exclusions, custom rules, or a business_context.md. Do not use to create credentials (use connect) or to auto-discover metadata from live labels/tags (use business-context-resolver).

Auto-discover K8s labels, AWS tags, GitHub CODEOWNERS and generate computed_metadata.jsonl for metadata-driven audit filtering, escalation, and cost sensitivity. Read-only discovery only; no mutations to live services.

Interactive inventory selection + batching for large estates. Before running audit-all, users select which services and regions to audit, saving the scope to topology.json for reuse. On large estates (1000+ resources), automatically batches queries to control token costs. Use when auditing multi-service environments with cost constraints.

Guided credential setup; creates minimal-scope tokens per tier for Grafana, Sentry, PagerDuty, Datadog, ELK/Kibana, JSM Operations, Zenduty, Groundcover, Prometheus, Loki, Tempo, Mimir, VictoriaMetrics, ClickStack (ClickHouse + HyperDX), SigNoz, New Relic, DigitalOcean, GCP, Azure, AWS, Kubernetes, and Slack, and writes ~/.scoutflo/toolkit.yaml. Use when the user wants to connect or onboard the toolkit, add an integration, rotate a token, or set up credentials, including the audit-brief Slack webhook. Do not use for alert-delivery webhooks (Grafana contact points, Alertmanager receivers; use setup-grafana or setup-lgtm) or to verify reachability (use doctor).

Harness skill (run it directly, or let audit-all run it for you): after any audit(s) (audit-all, sequential, or targeted 2-3), builds correlation.json that detects redundant monitoring (AWS + Grafana monitoring same metric), cascade risks (A fails → B disabled → C undetected), and business context filtering (staging gaps marked intentional, critical services prioritized). Works incrementally with partial coverage. Run automatically by audit-all (Phase 3.5); its output is also consumed by rca and the topology-guided-setup helper.

Internal roll-up harness (v0.1.67+): inside /scoutflo:audit-all, aggregates the cost-optimization findings the individual audits already wrote (area cost-optimization — AWSOPT-*, DDOPT-*), de-duplicates them via correlation.json, and writes a combined cost roll-up. It ALWAYS regenerates (no skip, no cache) and re-reads existing findings only; it does NOT query providers. For a DEEP, live, per-resource cost analysis, use /scoutflo:audit-cost. Wired into /scoutflo:audit-all after the correlation engine.

Preflight connection check; a bundled read-only script reads ~/.scoutflo/toolkit.yaml, makes one cheap call per configured integration, and emits a JSON-per-check matrix with fix hints and distinct exit codes. Use when the user mentions doctor, preflight, connection check, cannot reach Grafana, Sentry, or Prometheus, 401 or timeout errors before an audit, or blocked audit checks. Do not use to create or rotate credentials (use connect) or for scored assessment (use the audit-* skills).

Builds a read-only, human-confirmed map from your services to their GitHub repositories and writes repo-map.md plus a machine-readable repo-map.json keyed on each repo's immutable numeric id. Use when the user asks to map services to repos, find which repo backs a service, link code to services, or build a service-to-repository map. Never auto-accepts a match; every service is confirmed by the user. Do not use for cluster/traffic topology (use map-topology) or to score anything (use an audit-* skill).

Read-only, evidence-cited migration PLAN between two configured observability providers — currently Datadog → SigNoz. Inventories every source object (monitors, SLOs, synthetics, dashboards, downtimes, log pipelines), joins the audits' findings + measured fire-history so dead weight is proposed for dropping instead of being lifted-and-shifted, maps each object to its target equivalent with an honest equivalence class (direct/approximate/manual/none), and produces a migration inventory + gap table + parallel-run/cutover plan. Use when the user wants to migrate, compare, or plan a move from Datadog to SigNoz (or asks for a migration inventory). Do not use to EXECUTE a migration — this skill changes nothing on either side; it plans, and the setup lane (or your team) executes.

Answer "why is <resource/service> failing / at risk — give me the RCA" with a live, evidence-cited root cause. It uses your existing audit reports as REFERENCE (what's known, where to look), the service topology as the BLAST-RADIUS MAP (every attached resource/service, who calls whom, what monitors it), and then makes strictly READ-ONLY live calls (kubectl get/describe/events/logs) on the failing resource and its attached suspects to confirm the current truth. Every claim cites its source and is tagged [report@date] or [live@now]; it never invents a cause, and it degrades to a report-only answer when it has no live access. Use when the user asks why something is failing/degraded/at risk, asks for an RCA or root cause, or asks for a finding's blast radius or upstream cause. Do not use to change anything (analysis only, read-only), or to invent a cause when signal is thin (it says so instead).

Sets up recurring audits by filling a GitHub Actions workflow, crontab entry, or Claude cloud schedule that runs audit-all headless with an optional Slack brief, writing the file only after approval. Use when the user asks to schedule audits, run audits weekly or nightly, automate recurring audits, or set up a cron or CI audit job. Do not use to run an audit now (use audit-all) or to set up credentials (use connect).

Guided hardening of AWS reliability observability from audit-aws findings; creates and repairs CloudWatch alarms, SNS alert routing, compute health signals, RDS backup/storage-autoscaling config, Route53 and target-group uptime alarms, and CloudWatch Logs forwarding and retention, announcing each change, waiting for confirmation, then verifying live. Use when the user asks to fix an AWS-NNN finding, wire AWS alert routing, add CloudWatch alarms, or harden RDS/EC2/ECS/EKS/Lambda alerting. Do not use for read-only assessment (use audit-aws), for in-cluster LGTM or Grafana on EKS (use setup-lgtm or setup-grafana), for Alertmanager-specific routing (use audit-alertmanager), or to resize, delete, or purchase anything against an AWSOPT-* cost finding (this skill never automates cost writes; see Plan cost optimizations).

Guided hardening of Azure Monitor from audit-azure findings; creates and repairs action groups, metric alerts, scheduled-query (log) alerts, activity-log alerts, VM/VMSS alerts, AKS Container Insights and managed Prometheus, and diagnostic settings to Log Analytics, announcing each change, waiting for confirmation, then verifying live. Monitoring-plane writes only. Use when the user asks to fix an AZR-NNN finding, wire Azure alert routing, add metric or log alerts, or enable AKS monitoring. Do not use for read-only assessment (use audit-azure), for in-cluster stacks (use setup-lgtm), or for VM agent installs, network/health-probe changes, or RBAC role assignments (planned here, executed only by an identity that holds Owner/User Access Administrator).

Guided hardening of a ClickStack (ClickHouse + HyperDX + OpenTelemetry) stack from audit-clickstack findings. Sets deliberate per-table retention TTL on the otel_* telemetry tables, creates a HyperDX alert wired to a live receiver, creates a scoped read-only ClickHouse user for audits, and hardens ClickHouse auth (plaintext_password to sha256_password, default-user password). States each change, waits for your confirmation, executes one object at a time, then re-reads and verifies live. Use when the user asks to fix a CS-NNN finding, set otel_* retention, wire a HyperDX alert to a receiver, create a read-only ClickHouse audit user, or move a ClickHouse user off plaintext_password. Do not use for read-only assessment (use audit-clickstack), for Grafana-fronted dashboards (use setup-grafana), or for the Alertmanager paging path (use audit-alertmanager).

Guided hardening of DigitalOcean observability from audit-digitalocean findings; provisions alert destinations, uptime checks, App Platform alert rules and health checks, database alert policies, and log forwarding, announcing each change, waiting for confirmation, then verifying live. Use when the user asks to fix a DO-NNN finding, wire DO alert routing, add uptime checks, or harden App Platform or managed-database alerting. Do not use for read-only assessment (use audit-digitalocean) or for DOKS in-cluster stacks (use setup-lgtm).

Guided hardening of Google Cloud Monitoring from audit-gcp findings; creates and repairs notification channels, uptime checks, alert policies, logs-based metrics, and dashboards, announcing each change, waiting for confirmation, then verifying live. Monitoring-plane writes only. Use when the user asks to fix a GCP-NNN finding, wire GCP alert routing, add uptime checks or alert policies, or create logs-based metrics. Do not use for read-only assessment (use audit-gcp), for in-cluster stacks (use setup-lgtm), or for Ops Agent installs and VM, GKE, load balancer, firewall, or IAM changes (planned here, never executed).

Guided hardening of Grafana datasources, dashboards, contact points, notification policies, and alert rules from audit-grafana findings; announces each change, waits for confirmation, applies, then verifies live. Use when the user asks to fix a GRAF-NNN finding, wire or repair contact points, clean up broken panels or datasources, or harden Grafana alerting. Do not use for backend stores like Loki or Mimir (use setup-lgtm) or for read-only assessment (use audit-grafana).

Guided hardening of a Kubernetes cluster from audit-kubernetes findings; labels namespaces for Pod Security Admission, tightens over-permissioned workload RBAC, adds default-deny NetworkPolicies, sets workload resource limits, and adds PodDisruptionBudgets — announcing each change, waiting for explicit confirmation, then re-reading and verifying live. Use when the user asks to fix a K8S-NNN finding, enforce pod security, tighten cluster RBAC, add network policies, set resource limits, or add disruption budgets. Do not use for read-only assessment (use audit-kubernetes), for in-cluster LGTM/Grafana telemetry (use setup-lgtm/setup-grafana), or for cloud control-plane changes (use setup-aws/setup-gcp).

Guided hardening of LGTM and VictoriaMetrics-family stacks from audit-lgtm findings; fixes alert receivers and routing, retention, HA, ingress exposure, NetworkPolicies, PodDisruptionBudgets, and service-label alignment, announcing each change, waiting for confirmation, then verifying live. Use when the user asks to fix an LGTM-NNN finding, wire or repair Alertmanager or vmalert routing, quiet noisy rules, harden retention or HA, lock down exposed monitoring endpoints, or standardize service labels across metrics, logs, and traces. Do not use for the Grafana application layer such as dashboards or contact points (use setup-grafana), for proving alerts reach a human (use audit-alertmanager), or for read-only assessment (use audit-lgtm).

Guided, confirm-then-verify remediation of the gaps audit-newrelic finds in a New Relic account — wiring workflows to uncaught policies, creating per-service alert conditions from golden metrics, fixing condition tiering/evaluation/loss-of-signal settings, retiring dead-weight conditions, scheduling muting rules, adding SLOs, ownership tags, synthetic monitors, and change tracking. Every change is announced with its exact NerdGraph mutation and rollback, applied only after explicit approval, and verified by re-read. Use when the user asks to fix, remediate, or harden New Relic alerting or coverage, or follows an audit-newrelic finding's pointer. Do not use to audit (use audit-newrelic) or for the collector-side OTel pipeline (that lives in the shipping cluster's own config).

Guided hardening of a Sentry org from audit findings. Creates projects, seeds environments, applies privacy scrubbing, wires two-tier alert routing, and configures monitors. States each change, waits for your confirmation, then verifies live. Use when the user asks to fix a SNTRY-NNN finding, wire up Sentry alert routing or integrations (Slack, PagerDuty, GitHub), apply privacy scrubbing or rate-limit hardening, set up releases and source maps, or harden monitor/cron and uptime check-ins. Do not use for Grafana dashboards that display Sentry data (use setup-lgtm or setup-grafana), for proving the Alertmanager paging path reaches a human (use audit-alertmanager), or for read-only assessment (use audit-sentry).

Orientation for the Scoutflo AI Readiness: the local-only guarantee, first steps, the full skill catalog, credential tiers, and where audit reports land. Use when the user asks where to start, what the toolkit can do, which skills exist, how reports and scoring work, or whether any data leaves their machine. Do not use to create credentials (use connect), to check config health (use doctor), or to run an audit (use audit-all or a specific audit skill).

Internal harness library (v0.1.66+): an available helper a setup skill can source to make topology-aware fix decisions from correlation.json + business-context — detect redundant monitoring (skip or dedup), find cascade risks (fix root causes first), apply business context (critical services require approval, staging gaps intentional), estimate tokens, and suggest fix order. It exposes shell functions (topology_guided_get_recommendation, topology_guided_should_fix); it is a building block, not yet auto-invoked by the setup-* skills. Not a user-facing command.