运维检测事件路由

diegosouzapw2026-10-28查看 306复制 256

检测代理运行时异常，并通过审批安全的护栏路由事件。当您需要对 cron 失败、上下文压力、悬空会话、token 峰值进行确定性检查，以及受控的事件工作流（检测 -> 路由 -> 调查 -> 修复）时使用。

📘如何使用这个技能

1
复制技能内容·点击上方「Copy SKILL.md」复制全部内容，或 Download 下载到本地
2
打开你的 AI 客户端·支持 Claude Code、Trae、Cursor、ChatGPT、DeepSeek、Kimi 等任意 AI 助手
3
粘贴为系统提示/知识文件·Claude Code：放入 .claude/skills/ 目录；普通对话：作为首条消息发送并说「请严格按这份技能文档执行」
4
直接提出你的需求·AI 会按技能定义的工作流、格式和约束来处理，无需再解释背景

💡 提示：技能生效后，每次对话只需一句需求，AI 会按 SKILL.md 的流程执行。

SKILL.md2981 chars

---
name: ops-detection-incident-routing
description: Detect agent runtime anomalies and route incidents through approval-safe guardrails. Use when you need deterministic checks for cron failures, context pressure, dangling sessions, token spikes, and a controlled incident workflow (detect -> route -> investigate -> remediate).
homepage: https://github.com/your-org/openclaw-public-skills
metadata: {"clawdbot":{"emoji":"🛟","requires":{"bins":["bash","jq","python3"]}}}
---

# ops-detection-incident-routing

Run deterministic operations checks and route incidents with guardrails.

This skill ships a small toolkit for:

1. detecting runtime anomalies from local state/log files
2. applying in-flight + cooldown guards
3. emitting structured incident actions for investigator/remediator flows

## Use This Skill

Use this skill when you need a production-safe ops loop for agent systems and do not want ad-hoc prompt-only monitoring.

## Files

- `scripts/ops-threshold-detector.sh`
  reads session/cron/snapshot state and appends detector JSONL events
- `scripts/incident-guard-check.sh`
  checks in-flight/cooldown guard status for a check id
- `scripts/incident-state-update.sh`
  updates guard state for start/complete/fail transitions
- `scripts/ops-incident-router.sh`
  converts detector alerts into structured actions
- `scripts/ops-detector-cycle.sh`
  detector + router cycle runner
- `scripts/setup.sh`
  dependency checks + local example scaffold
- `scripts/clean-generated.sh`
  removes generated `.jsonl` and lock artifacts before republishing from a used folder

## Setup

```bash
bash scripts/setup.sh
```

## Quick Start

Run one full dry-run cycle:

```bash
bash scripts/ops-detector-cycle.sh \
  --workspace "$(pwd)/examples/workspace" \
  --state-file "$(pwd)/examples/incident-state.json" \
  --detector-out "$(pwd)/examples/ops-detector.jsonl" \
  --router-out "$(pwd)/examples/router-actions.jsonl"
```

Run live mode (router also acquires in-flight locks):

```bash
bash scripts/ops-detector-cycle.sh \
  --workspace "$(pwd)/examples/workspace" \
  --state-file "$(pwd)/examples/incident-state.json" \
  --detector-out "$(pwd)/examples/ops-detector.jsonl" \
  --router-out "$(pwd)/examples/router-actions.jsonl" \
  --live
```

## Output Contract

Detector writes one JSON line per run:

```json
{
  "ts": "2026-02-24T02:30:00Z",
  "status": "ALERT",
  "checks": 5,
  "alerts": [{"sev":"Sev-2","trigger":"cron_failure","value":2,"threshold":0}],
  "gaps": []
}
```

Router emits one JSON action per alert decision:

```json
{"action":"spawn","check_id":"cron_failure","severity":"Sev-2","mode":"dry-run","task":"Investigate incident: cron_failure"}
```

## Operational Pattern

1. schedule `ops-threshold-detector.sh` (every 5-15 min)
2. feed the latest detector line to `ops-incident-router.sh`
3. spawn investigator/remediator only from router output
4. keep remediation behind explicit owner approval

For details, read `references/architecture.md`.

来源：skillsdirectory

运维检测事件路由

📘如何使用这个技能

评论0