stag-ai-automation-governanceGovern production automations (runbook bots, agents, scheduled remediations) through STAG — detect failure spikes, retry storms, unknown outcomes and cost runaways per automation; pause safely as one approved operation; reconcile unknown outcomes from target state; measure cost per correct completed
stag-crew-authoringCreate, validate and run a STAG crew — a declarative composition of roles (agents + skills + permissions) and a workflow of backbone steps (coordinate, transition, investigate, propose_action, authorize, dispatch, verify, notify, record) in crews/<name>/crew.yaml with a scenario for end-to-end check
stag-customer-care-commsHandle a wave of customer impact through STAG — detect ticket surges, CSAT drops and blocked journeys per product area and region, correlate duplicates into one episode, link to the TechOps incident, publish proactive and resolution communications once with provenance, apply an approved known-issue
stag-dataops-pipeline-triageTriage and remediate data incidents with STAG — pipeline failures, data-quality drift, freshness SLA breaches and row-count collapses correlated per dataset; lineage-aware bounded investigation; idempotent backfill or quarantine as one approved operation; freshness and quality verification; single c
stag-log-analysisAnalyse log streams with STAG as evidence, not prompts — detect error signatures, volume bursts and collector lag; aggregate repeated lines into templates, counts and representative examples; run scoped read-only queries; prepare TTL-bounded sampling adjustments that preserve error levels; and assem
stag-multi-agent-orchestrationDesign or run STAG's multi-agent incident workflow — coordinator, investigator, remediation reviewer and recovery verifier — with handoff schemas, separate permissions, termination rules and conflict resolution, built on the deterministic backbone (incident state machine, assignment contracts, actio
stag-problem-managementRun ITIL-style problem management on STAG incident history — detect recurring incidents and repeated workarounds, open a problem record that links (not merges) incident episodes, drive evidence-based root-cause analysis, draft a known-error record with workaround, and take a permanent fix through ch
stag-release-gateGate releases and changes with live STAG evidence — change-freeze windows, open incidents on the service and its dependencies, canary health, emergency/hotfix flags — and prepare a policy-bounded rollback as one retry-safe operation with a recorded release decision. Use when deployment or canary sig
stag-security-governanceRun enterprise AI and data governance on STAG's security streams — shadow AI usage, sensitive data to unsanctioned tools, acceptable-use violations, anomalous usage from DLP, proxy, identity and CASB — as deduplicated cases per tool and department with bounded exposure investigation, an approved DLP
stag-skill-authoringCreate, validate and contribute a STAG skill that works in Claude Code, Codex and Cursor from one SKILL.md source. Use when adding a new TechOps workflow, a role skill, or a development skill to the STAG skill pack, or when reviewing a community skill PR. Covers the Agent Skills frontmatter rules, f
stag-stream-adapterBuild a new STAG stream source / adapter (stag/streams) as a governed product — stable event identity, checkpointing, backfill and replay rules, schema-drift handling, fixtures and tests. Use when connecting Kafka topics, webhooks, SaaS audit logs, OpenTelemetry or any new source to STAG. Ensures re
stag-techops-bounded-investigationRun or author a bounded, evidence-grounded incident investigation for STAG TechOps under an explicit assignment contract (scope, permitted capabilities, call/time limits, required output). Use when an InvestigationRequest exists, when asked "why is this happening", or when writing the investigate st
stag-techops-dedup-correlationDecide what is actually repeating in a STAG stream and apply the right control — redelivery vs repeated symptom vs continuing signal vs duplicate ticket vs reingested document vs retried tool call. Use when counts look inflated, tickets multiply, "the same alert keeps firing", or when designing iden
stag-techops-enterprise-onboardingOnboard an application, service or SaaS platform into enterprise STAG — register identity and ownership, define the normalization envelope, classify data (sensitivity, type, residency, trust, importance, purpose), compute eligible processing routes, and assign budgets. Use when connecting a new sour
stag-techops-incident-triageTriage a new STAG signal or incident episode for TechOps. Use when a trigger fires, an alert pages, a new incident appears in /api/techops/incidents, or someone asks "is this real, how bad is it, who owns it?". Produces a triage record (identity check, impact, severity, ownership, paging decision) w
stag-techops-postmortemDraft a blameless postmortem for a STAG incident from its recorded history (observations, transitions, investigations, actions, verification) and compute the inspectable metrics (false merges/splits, duplicate side effects, time to useful triage, verified restoration time, fully loaded cost). Use af
stag-techops-recovery-verificationVerify that a STAG incident has actually recovered after mitigation, using independent health signals over a defined observation window with hysteresis. Use when an action was dispatched, when someone says "looks fixed, can we close it?", or when deciding RESOLVED vs INVESTIGATING again. Treats miss
stag-techops-remediation-ledgerPropose, authorize, dispatch, reconcile and verify a remediation action for a STAG incident using durable operation identity so nothing is executed twice. Use when an investigation proposes a mitigation, when an operator asks to "restart/rollback/scale X", when a tool call timed out with unknown out
stag-techops-resilience-testsGenerate or review the failure-scenario test suite for a STAG deployment — redelivery, similar-but-distinct errors, false merges, concurrent workers, late events, reingested runbooks, lost action responses, LLM outage, prompt injection via telemetry, collector silence and historical replay. Use when
stag-techops-signal-tuningTune STAG's detection cadence and alert hygiene — debounce, cooldown, hysteresis, inhibition, burn-rate/multi-window SLO alerting, late-event and replay policy, backpressure. Use when alerts are noisy or flapping, when investigations fire too often or too rarely, when paging depends on AI, or when s
stag-trigger-rule-authoringAdd or modify a STAG trigger rule (stag/triggers/rules.py) with tests and registry wiring. Use when asked to detect a new condition in the stream, change thresholds, or when a rule fires too often or too rarely. Keeps rules deterministic, confidence-scored and covered by tests; defers cadence to the