Monitor
Strategy
- Select preset (determines data source and key metrics)
- Gather health data from the source
- Compare against baseline/thresholds
- Rate: healthy / degraded / critical
- Format report
- Alert if critical
- If
--recurring: schedule next run
Exit: report delivered. For recurring: runs until cancelled.
Report requirements (every report MUST include)
- Specific metric values: exact numbers, not just "high" or "degraded"
- Trend direction: is each metric improving, stable, or worsening vs baseline?
- Actionable items: concrete next steps ranked by urgency, not just observations
- Anomaly callouts: flag anything outside expected range with the specific threshold breached
Note: Placeholders like {user_question} in Agent prompts are filled by you (Claude)
from the current task context. They are not template variables — read the user input,
gather the relevant context, and substitute before spawning the agent.
Agents
GATHER phase
Agent(subagent_type="Explore", model="haiku", prompt="""
Gather health data for: {target}
Preset: {preset}
Data sources to check:
{preset_data_sources}
Key metrics to collect:
{preset_metrics}
Output: raw metrics with timestamps.
""")
ASSESS + REPORT phase
Agent(model="sonnet", prompt="""
Health data:
{gathered_metrics}
Baseline (last {baseline_days} days):
{baseline_data}
1. Compare current vs baseline
2. Flag anomalies (>2 stddev from baseline)
3. Rate overall: HEALTHY / DEGRADED / CRITICAL
4. Format as a concise health report
""")
Presets
| Preset |
Sources |
Metrics |
--service NAME |
Observability platform, tracing |
Latency p50/p99, error rate, throughput, instance count |
--pipeline NAME |
Pipeline orchestrator |
Success rate, SLA compliance, last failure |
--ci |
CI/CD platform |
Build success rate, flaky test %, avg build time |
--deploy APP |
Deployment platform |
Deploy state, canary score, pending constraints |
--ml FLOW |
ML platform |
Run status, latest metrics, accuracy trend |
--code REPO |
Git history |
TODO/FIXME count, test coverage, PR merge rate |
--deps REPO |
pip/npm audit, CVE DBs |
Outdated count, critical CVEs, last updated |
--docs |
Documentation platform |
Pages not updated in 90d, broken links |
--team NAME |
GitHub, Slack, Jira |
PR velocity, open issues, Slack activity |
--oncall |
PagerDuty, incident log |
Open incidents, MTTR, handoff notes |
Cross-provider review
When cross-provider tools are available, run verification on a non-Claude model
in parallel for maximum blind-spot diversity.
Flags
--recurring=INTERVAL — repeat on schedule (daily, hourly, etc.)
--alert=CHANNEL — notification channel for critical alerts
--baseline=N — days of baseline data (default: 14)
Examples
/monitor --service my-api
/monitor --pipeline etl-daily --recurring=daily
/monitor --ci --alert=#builds
/monitor --team platform-eng
/monitor --code --baseline=30
/monitor --oncall
Execution routing (sagaflow-first)
Sagaflow is the default execution path. The in-session workflow above is the FALLBACK, used only when the sagaflow worker is confirmed unavailable.
Routing sequence (mandatory before any in-session work):
0. If one-shot health check (not --recurring) → produce report directly in-session. Do NOT route to sagaflow.
- Run
sagaflow doctor
- If healthy → launch via sagaflow below. Stop. Do not run in-session.
- If unhealthy → log
SAGAFLOW_UNAVAILABLE, proceed with in-session fallback.
Launch command:
Bash(
run_in_background=true,
command="sagaflow launch monitor --arg target='<TARGET>' --arg preset=auto --arg recurring=false --await"
)
1---2name: monitor3description: Use when the user asks to monitor, health-check, watch, or check status of services, pipelines, code, teams, builds, deployments, or CI. Also triggers for "is X healthy", "check on Y", "watch Z". Runs one-shot or recurring, parameterized by data source.4---56# Monitor78## Strategy9101. Select preset (determines data source and key metrics)112. Gather health data from the source123. Compare against baseline/thresholds134. Rate: healthy / degraded / critical145. Format report156. Alert if critical167. If `--recurring`: schedule next run1718Exit: report delivered. For recurring: runs until cancelled.1920## Report requirements (every report MUST include)2122- **Specific metric values**: exact numbers, not just "high" or "degraded"23- **Trend direction**: is each metric improving, stable, or worsening vs baseline?24- **Actionable items**: concrete next steps ranked by urgency, not just observations25- **Anomaly callouts**: flag anything outside expected range with the specific threshold breached262728> **Note:** Placeholders like `{user_question}` in Agent prompts are filled by you (Claude)29> from the current task context. They are not template variables — read the user input,30> gather the relevant context, and substitute before spawning the agent.3132## Agents3334### GATHER phase3536```37Agent(subagent_type="Explore", model="haiku", prompt="""38Gather health data for: {target}39Preset: {preset}4041Data sources to check:42{preset_data_sources}4344Key metrics to collect:45{preset_metrics}4647Output: raw metrics with timestamps.48""")49```5051### ASSESS + REPORT phase5253```54Agent(model="sonnet", prompt="""55Health data:56{gathered_metrics}5758Baseline (last {baseline_days} days):59{baseline_data}60611. Compare current vs baseline622. Flag anomalies (>2 stddev from baseline)633. Rate overall: HEALTHY / DEGRADED / CRITICAL644. Format as a concise health report65""")66```6768## Presets6970| Preset | Sources | Metrics |71|---|---|---|72| `--service NAME` | Observability platform, tracing | Latency p50/p99, error rate, throughput, instance count |73| `--pipeline NAME` | Pipeline orchestrator | Success rate, SLA compliance, last failure |74| `--ci` | CI/CD platform | Build success rate, flaky test %, avg build time |75| `--deploy APP` | Deployment platform | Deploy state, canary score, pending constraints |76| `--ml FLOW` | ML platform | Run status, latest metrics, accuracy trend |77| `--code REPO` | Git history | TODO/FIXME count, test coverage, PR merge rate |78| `--deps REPO` | pip/npm audit, CVE DBs | Outdated count, critical CVEs, last updated |79| `--docs` | Documentation platform | Pages not updated in 90d, broken links |80| `--team NAME` | GitHub, Slack, Jira | PR velocity, open issues, Slack activity |81| `--oncall` | PagerDuty, incident log | Open incidents, MTTR, handoff notes |8283## Cross-provider review8485When cross-provider tools are available, run verification on a non-Claude model86in parallel for maximum blind-spot diversity.8788## Flags8990- `--recurring=INTERVAL` — repeat on schedule (daily, hourly, etc.)91- `--alert=CHANNEL` — notification channel for critical alerts92- `--baseline=N` — days of baseline data (default: 14)9394## Examples9596```97/monitor --service my-api98/monitor --pipeline etl-daily --recurring=daily99/monitor --ci --alert=#builds100/monitor --team platform-eng101/monitor --code --baseline=30102/monitor --oncall103```104105## Execution routing (sagaflow-first)106107**Sagaflow is the default execution path.** The in-session workflow above is the FALLBACK, used only when the sagaflow worker is confirmed unavailable.108109**Routing sequence (mandatory before any in-session work):**1100. If one-shot health check (not `--recurring`) → produce report directly in-session. Do NOT route to sagaflow.1111. Run `sagaflow doctor`1122. If healthy → launch via sagaflow below. Stop. Do not run in-session.1133. If unhealthy → log `SAGAFLOW_UNAVAILABLE`, proceed with in-session fallback.114115**Launch command:**116```117Bash(118 run_in_background=true,119 command="sagaflow launch monitor --arg target='<TARGET>' --arg preset=auto --arg recurring=false --await"120)121```