# Observability Triage

Triage OpenSEO production errors in Cloudflare Workers Observability, verified query...

- Repository: https://github.com/every-app/open-seo (25988 stars)
- Category: DevOps
- License: MIT
- Last updated: 2026-10-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add every-app/open-seo --skill observability-triage -g -a claude-code -y`
Codex: `npx skills add every-app/open-seo --skill observability-triage -g -a codex -y`
Cursor: `npx skills add every-app/open-seo --skill observability-triage -g -a cursor -y`
Gemini CLI: `npx skills add every-app/open-seo --skill observability-triage -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add every-app/open-seo`

## Description

Triage OpenSEO production errors in Cloudflare Workers Observability, verified query recipes, counting gotchas, a known-noise filter list applied automatically, and the on-demand CPU/heap profiling recipe. Use when asked to review Cloudflare logs/observability, count OOMs or worker errors, compare error rates between periods, investigate a prod error spike, or find where a worker spends CPU or memory (profiles, flamegraphs).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Observability triage

Query Cloudflare Workers Observability for prod errors, count them correctly, and skip the noise that has already been investigated to a dead end. Apply the known-noise list below without re-investigating those entries.

## Access

- Resolve the account at runtime, never hardcode it: the `cloudflare-api` MCP server pre-binds `accountId` in `mcp__cloudflare-api__execute`, and `npx wrangler whoami` prints it. The workers to triage are the ones this repo deploys (see `deploy/alchemy/alchemy.run.ts`): the main app worker plus the aux workers (audit engine, landing, self-host).
- Query via the `cloudflare-api` MCP server (`mcp__cloudflare-api__execute`). If its tools are absent, run its authenticate flow and give the user the URL, **wrangler's OAuth token gets a 403 on the observability API** (missing scope), so don't burn time on curl-with-wrangler-token.
- PostHog is the second error source but **cannot see** `exceededMemory` / `canceled` / `responseStreamDisconnected` outcomes, worker-outcome questions are answerable only here.

## Query recipes (verified shapes)

`POST /accounts/{account_id}/workers/observability/telemetry/query`. All of these are load-bearing; the API's 400s are opaque:

- `queryId: "adhoc"` is required. Timeframe is epoch **milliseconds**: `timeframe: { from, to }`.
- Count invocations by outcome:

  ```json
  {
    "queryId": "adhoc",
    "timeframe": { "from": 0, "to": 0 },
    "parameters": {
      "datasets": ["cloudflare-workers"],
      "filters": [
        { "key": "$metadata.type", "operation": "eq", "value": "cf-worker-event", "type": "string" }
      ],
      "calculations": [{ "operator": "count", "alias": "count" }],
      "groupBys": [
        { "value": "$workers.scriptName", "type": "string" },
        { "value": "$workers.outcome", "type": "string" }
      ],
      "limit": 100
    },
    "view": "calculations",
    "limit": 100
  }
  ```

The rest: https://github.com/every-app/open-seo/blob/HEAD/.agents/skills/observability-triage/SKILL.md