Observability AIops

[READ] Configured Grafana datasources (id, uid, name, type, default). Args: target: Grafana target name from config; omit for the default.

[READ] Grafana folders. Args: target: Grafana target name from config; omit for the default.

[READ] All recording + alerting rules, optionally filtered by type. Args: rule_type: Filter by "alerting" or "recording"; omit for both. target: Prometheus target name from config; omit for the default.

[READ] Alertmanager silences (active, pending, expired). Args: target: Prometheus target name from config (its Alertmanager); omit for default.

[READ] Active scrape targets, optionally filtered by health (up/down). Args: health: Filter by health state ("up" or "down"); omit for all. target: Prometheus target name from config; omit for the default.

[READ][analysis] Root-cause an error burst: current window vs baseline, per stream. Pulls error streams for the current window (now-hours..now) and an equal-length baseline window (now-2*hours..now-hours), then classifies each burst as a new error signature, a volume spike, or a single-instance burst — with a cause + action. If the baseline window had no logs at all (retention or ingestion gap), streams are classified ``no_baseline`` rather than new: an empty baseline is not evidence of a regression. Advisory heuristic; verify against the raw logs. Args: selector: A Loki stream selector …

[READ][analysis] Top streams by volume + high-cardinality (high-churn) label warnings. Ranks the highest-volume streams under the selector, flags labels with many distinct values as cardinality-explosion risks, and adds a retention hint from Loki index stats when available. Args: selector: A Loki stream selector to scope the analysis (e.g. '{namespace="prod"}'). hours: Lookback window in hours (capped at the tool's max lookback). loki_target: Loki target name from config; omit for the default.

[READ] Distinct values of one Loki label (bounded). Args: name: Label name to enumerate (e.g. 'app', 'namespace'). hours: Lookback window in hours (capped at the tool's max lookback). target: Loki target name from config; omit for the default.

[READ] Distinct Loki label names present in the lookback window. Args: hours: Lookback window in hours (capped at the tool's max lookback). target: Loki target name from config; omit for the default.

[READ] Bounded LogQL query_range passthrough (validation-gated). The query MUST carry a stream selector (e.g. '{app="api"}') — an unbounded query with no selector is rejected. Lookback is capped and the line count is clamped. Args: logql: A LogQL query with a stream selector (e.g. '{job="api"} |= "error"'). hours: Lookback window in hours (capped at the tool's max lookback). limit: Max log lines to return (clamped to the tool's max line limit). target: Loki target name from config; omit for the default. Returns an envelope with ``returned``/``limit``/``truncated``. If ``trun…

[READ] Canned error-level read for a stream selector (error line-filter). Args: selector: A Loki stream selector (e.g. '{app="api"}' or 'app="api"'). hours: Lookback window in hours (capped at the tool's max lookback). limit: Max log lines to return (clamped to the tool's max line limit). target: Loki target name from config; omit for the default. Returns an envelope with ``returned``/``limit``/``truncated``. If ``truncated`` is true the result is partial — re-run with a higher limit.

[READ] Platform-aware health snapshot for the target. Prometheus: firing-alert count + scrape up/down + rules erroring. Grafana: dashboard / datasource / folder counts. Args: target: Target name from config; omit for the default.

[READ] Pending (not-yet-firing) Prometheus rule alerts, by severity. Args: target: Prometheus target name from config; omit for the default.

[READ] Running-config fingerprint + size (never the raw YAML/secrets). Args: target: Prometheus target name from config; omit for the default.

[READ] TSDB head cardinality stats + the top metrics by series count. Args: target: Prometheus target name from config; omit for the default.

[READ] Evaluate a PromQL expression over a time range. Args: query: A PromQL expression. start: Range start (RFC-3339 or unix timestamp). end: Range end (RFC-3339 or unix timestamp). step: Resolution step (e.g. '60s', '5m'). target: Prometheus target name from config; omit for the default. Returns an envelope with ``returned``/``limit``/``truncated``. If ``truncated`` is true the result is partial — narrow the selector or raise the limit rather than treating it as complete.

[WRITE][risk=medium] Hot-reload the Prometheus config (POST /-/reload). No undo. Records the pre-reload config hash. Rollback = re-apply the prior config file. Args: dry_run: If True, preview (reports the current config hash) without reloading. target: Prometheus target name from config; omit for the default.

[READ] Rule-evaluation health summary + the list of erroring rules. Args: target: Prometheus target name from config; omit for the default.

[READ] Series (label-set) metadata for a PromQL selector. Args: match: A PromQL series selector (e.g. 'up{job="node"}'). start: Optional range start (RFC-3339 or unix timestamp). end: Optional range end (RFC-3339 or unix timestamp). target: Prometheus target name from config; omit for the default. Returns an envelope with ``returned``/``limit``/``truncated``. If ``truncated`` is true the result is partial — narrow the selector or raise the limit rather than treating it as complete.

[READ] Up/down scrape-health summary plus the list of unhealthy targets. Args: target: Prometheus target name from config; omit for the default.

[READ][analysis] Rank down/erroring scrape targets and classify each cause. Args: target: Prometheus target name from config; omit for the default.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool. The inverse runs through its own governed tool, so its real risk tier is recorded there too. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once. Args: undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[READ] List recorded, not-yet-applied undo tokens (most recent first). Each entry names the original tool, the inverse tool that ``undo_apply`` would run, and a human note. Use the ``undoId`` with ``undo_apply``. ``truncated`` is measured (one extra row is fetched), not guessed from a length coincidence — when it is true, re-run with a higher ``limit``. Each entry carries ``effectVerified``. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that m…

[WRITE][risk=medium] Update a Grafana dashboard. Captures the prior model for undo. The dashboard model must include its ``uid``. The current model is fetched first and stashed so the harness records a restore undo. Args: dashboard: Full dashboard model (must include "uid"). overwrite: Overwrite the existing dashboard version (default True). dry_run: If True, preview without updating. target: Grafana target name from config; omit for the default.