[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699ZJ6BJ3RTM6JXATEBA9VF":3,"skill-same:01M699ZJ6BJ3RTM6JXATEBA9VF":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M699ZJ6BJ3RTM6JXATEBA9VF","performance-investigation",null,"Use for Zava Learning incidents where the platform is reachable but a compute tier is degraded — elevated 5xx from the APIs, slow quiz responses, exceptions, an API with no healthy instances, or a back-office batch job failing on the reporting-worker VM (e.g. nightly grade exports). Diagnoses from Application Insights \u002F Log Analytics \u002F Syslog and remediates the application or worker tier.","microsoft\u002Fsre-agent","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699YP84JQDX8CY79ZD1TTEF",188,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fperformance-investigation\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000039","教师与教育","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,9],"performance","performance investigation","investigation","failing","docs","for","incidents","insights","quiz","platform","worker","back","instances","use","fetch","learning","api","syslog","search","vm","learn","analytics","2026-11-10 10:12:30",false,"---\nmetadata:\n  api_version: azuresre.ai\u002Fv2\n  kind: Skill\nname: performance-investigation\ndescription: Use for Zava Learning incidents where the platform is reachable but a compute tier is degraded — elevated 5xx from the APIs, slow quiz responses, exceptions, an API with no healthy instances, or a back-office batch job failing on the reporting-worker VM (e.g. nightly grade exports). Diagnoses from Application Insights \u002F Log Analytics \u002F Syslog and remediates the application or worker tier.\ntools:\n  - RunAzCliReadCommands\n  - RunAzCliWriteCommands\n  - GetAzCliHelp\n  - SearchMemory\n  - ExecutePythonCode\n  - microsoft-learn_microsoft_docs_search\n  - microsoft-learn_microsoft_docs_fetch\n---\n\n## Zava Learning — Application Incident Runbook\n\nResource Group: `@@RG@@`. Services (Container Apps): `learner-portal`, `course-api`, `assessment-api`.\nQuiz launch path: portal -> assessment-api -> course-api.\n\nConfirm the network\u002Fedge is healthy first (App Gateway backend healthy, NSG clean) so you don't\nmisattribute an app fault. Then:\n\n1. Query App Insights failures\u002Fexceptions filtered by the failing `cloud_RoleName`.\n2. Check Container App revision health and replica counts — an API with zero replicas serves no\n   requests and surfaces as quiz launch \u002F 502 failures with a clean network path. A revision can hit\n   zero replicas two ways: scaled to zero, OR the active revision was **deactivated** (an inactive\n   revision runs zero replicas). `az containerapp revision list` shows only ACTIVE revisions, so a\n   deactivated lane looks like it has \"no revisions\" — list with `--all` and inspect\n   `properties.active` \u002F `properties.latestRevisionName`. The latent cause is often a scale floor of\n   zero in IaC (`appLaneMinReplicas: 0`); the durable fix restores a non-zero minimum.\n3. Inspect recent revisions\u002Fconfig changes.\n4. For LATENCY regressions (slow quiz responses \u002F the latency alert) on a clean network path: pull assessment-api request durations from Log Analytics console logs (each request logs `ms=\u003Cduration>`), find the step-change in latency and align it to the most recent assessment-api revision\u002Fimage deployment, then inspect `src\u002Fassessment-api\u002Fserver.js` for expensive synchronous work added on the request path (e.g. a synchronous KDF\u002Fcrypto call). This is a code regression — mitigate live by rolling back to the prior revision, then fix durably with a code PR.\n\n## Reporting-worker grade-export failures\nIf the symptom is the nightly grade-export job failing (no quiz\u002Fportal impact — this is a back-office\nbatch job on a dedicated VM `vm-zava-reporting-*`):\n1. Query Log Analytics `Syslog` for `ProcessName == \"zava-export\"` — the worker logs a heartbeat on\n   success and a `FAILED` line plus the raw OS error (`export write error: ...`) on failure. Read the\n   raw error to identify the failure mode.\n2. Correlate with disk telemetry: the `Perf` table carries Logical Disk `% Used Space` and\n   `Free Megabytes` for the worker. A data volume (`\u002Fdata`) at ~100% used \u002F near-zero free is the\n   signal that the export writes are failing for lack of space.\n3. Confirm on the VM with a read command (`az vm run-command invoke ... --scripts \"df -h \u002Fdata\"`).\n4. Mitigate live: free space on the worker's data disk (remove the accumulated backlog file under\n   `\u002Fdata\u002Fexports`) via `az vm run-command`. Re-check that the next export run logs a success heartbeat.\n5. Durable fix: the worker's export retention\u002Frotation lives in `src\u002Freporting-worker\u002Fcloud-init.yaml`\n   — a PR that enforces retention (or grows the data disk in `infra\u002Fmodules\u002Fvm.bicep`) is the lasting fix.\n\n## Database-backed quiz lanes (slow loading \u002F errors under load \u002F auth failures)\nThe quiz lanes read PostgreSQL on the request path, so a DB fault produces app-shaped symptoms on a\nclean edge + healthy replicas. Do NOT stop at \"the DB looks slow\" and report root cause unknown —\nidentify WHICH database surface — log-first, confirm from the lane's error `detail`, then optionally\nverify in the database:\n1. Read the quiz service's console logs (`ContainerAppConsoleLogs_CL` for the failing `quiz-*` app \u002F\n   `assessment-api`) for the request shape: a slow `ms=\u003Cduration>` on `\u002Fquiz\u002F*` → index\u002Flatency;\n   a burst of `status=500` on `\u002Fquiz\u002F*` (and any `pool error:` lines) → a backend DB failure.\n2. Get the EXACT backend error straight from the lane — the service returns the underlying Postgres\n   error in the response `detail` field (it is NOT written to the logs): `curl` the lane's `\u002Fhealth`\n   (returns `503 {\"status\":\"degraded\",\"detail\":\"\u003Cpg error>\"}` when the DB path is broken) or\n   `\u002Fquiz\u002F\u003CcourseId>` (`500 {\"error\":\"...\",\"detail\":\"\u003Cpg error>\"}`). The `detail` names the cause\n   directly — e.g. `password authentication failed` (28P01) → bad DB secret; `too many connections`\n   \u002F `remaining connection slots` \u002F connection-limit → pool exhaustion; a slow-but-200 `\u002Fquiz` with\n   climbing `ms=` → missing index. This needs no DB credentials and is the primary confirmation.\n3. Optionally confirm against the database itself with a read-only query (connection recipe in the\n   knowledge base — server\u002Flogin from `az postgres flexible-server list`, admin password from Key\n   Vault `db-password`, then `az postgres flexible-server execute --querytext \"\u003CSQL>\"`):\n   - **Slow quiz loading (query lane, db `zava_query`):** check the `question_bank` indexes —\n     `SELECT indexname FROM pg_indexes WHERE tablename='question_bank';` and\n     `SELECT relname,seq_scan,idx_scan FROM pg_stat_user_tables WHERE relname='question_bank';`.\n     A missing index on `question_bank` with seq-scans climbing is the root cause; the durable fix is\n     to (re)build it (REINDEX\u002FCREATE INDEX) — delivered as a PR.\n   - **Errors under load (pool lane, db `zava`):** check the connecting role's connection limit —\n     `SELECT rolname,rolconnlimit FROM pg_roles WHERE rolname='app_pool';` and live connections in\n     `pg_stat_activity`. A `rolconnlimit` of 1 (or far below the pool size) is the root cause; restore\n     a sane limit (`ALTER ROLE app_pool CONNECTION LIMIT \u003Cn>`).\n   - **Authentication errors (secret lane):** the lane's Key Vault DB secret (`db-password-secretlane`)\n     was rotated to an invalid value — confirm the auth-failure log signature; the fix is to **restore a\n     valid value INTO `db-password-secretlane`** (copy it from the baseline `db-password` secret with\n     `az keyvault secret set`) and then force the lane to re-read it by **creating a NEW revision**\n     (`az containerapp update --set-env-vars FORCE_ROTATE=\u003Ctimestamp>`). A plain `az containerapp\n     revision restart` is NOT enough — Container Apps resolve Key Vault secret references at\n     revision-creation time, so a restart reuses the cached (still-invalid) value; only a new revision\n     re-reads the secret. Then re-check the lane returns 200. Do **NOT** run `az containerapp secret set` \u002F\n     re-assert the secret's `identityref` (unnecessary — the reference is already correct), and do **NOT**\n     repoint `pg-password` to a different Key Vault secret (e.g. the shared `db-password`) — that masks the\n     fault and breaks lane isolation; only the `db-password-secretlane` **value** should change.\n4. Mitigate live with the smallest corrective action (rebuild the index \u002F restore the connection limit\n   \u002F restore the secret), re-check the lane returns 200, then deliver the durable fix as a PR.\nBase the RCA on the confirmed surface above — DB-internal faults must resolve to a named cause (index,\nconnection limit, or secret), never \"root cause unknown.\"\n\n## Permitted autonomous actions\n- Restore replica counts \u002F restart a Container Apps revision.\n- Reactivate a deactivated revision (`az containerapp revision activate`) to bring back zero-replica lanes.\n- Roll back to the last-known-good revision.\n- Free space on the reporting-worker VM's data disk (remove an accumulated backlog file under `\u002Fdata`).\n\n## Code fix\nIf the root cause is in application source, the app code lives under `src\u002F` in `@@REPO@@`. After\nthe live mitigation (revision rollback\u002Frestart), the durable code fix is delivered as a GitHub PR\nby the `pr-delivery` skill and recorded as a Change Request by `servicenow-change-management`.\n\n## Incident communication\nPagerDuty acknowledgement, status\u002Fsummary notes, and resolution are owned by the\n`pagerduty-incident-update` skill.\n\n## Verification\nConfirm `\u002Fapi\u002Fquiz\u002F*` returns 200 and the API success rate is back to baseline.\n","## Zava Learning — Application Incident Runbook\n\nResource Group: `@@RG@@`. Services (Container Apps): `learner-portal`, `course-api`, `assessment-api`.\nQuiz launch path: portal -> assessment-api -> course-api.\n\nConfirm the network\u002Fedge is healthy first (App Gateway backend healthy, NSG clean) so you don't\nmisattribute an app fault. Then:\n\n1. Query App Insights failures\u002Fexceptions filtered by the failing `cloud_RoleName`.\n2. Check Container App revision health and replica counts — an API with zero replicas serves no\n   requests and surfaces as quiz launch \u002F 502 failures with a clean network path. A revision can hit\n   zero replicas two ways: scaled to zero, OR the active revision was **deactivated** (an inactive\n   revision runs zero replicas). `az containerapp revision list` shows only ACTIVE revisions, so a\n   deactivated lane looks like it has \"no revisions\" — list with `--all` and inspect\n   `properties.active` \u002F `properties.latestRevisionName`. The latent cause is often a scale floor of\n   zero in IaC (`appLaneMinReplicas: 0`); the durable fix restores a non-zero minimum.\n3. Inspect recent revisions\u002Fconfig changes.\n4. For LATENCY regressions (slow quiz responses \u002F the latency alert) on a clean network path: pull assessment-api request durations from Log Analytics console logs (each request logs `ms=\u003Cduration>`), find the step-change in latency and align it to the most recent assessment-api revision\u002Fimage deployment, then inspect `src\u002Fassessment-api\u002Fserver.js` for expensive synchronous work added on the request path (e.g. a synchronous KDF\u002Fcrypto call). This is a code regression — mitigate live by rolling back to the prior revision, then fix durably with a code PR.\n\n## Reporting-worker grade-export failures\nIf the symptom is the nightly grade-export job failing (no quiz\u002Fportal impact — this is a back-office\nbatch job on a dedicated VM `vm-zava-reporting-*`):\n1. Query Log Analytics `Syslog` for `ProcessName == \"zava-export\"` — the worker logs a heartbeat on\n   success and a `FAILED` line plus the raw OS error (`export write error: ...`) on failure. Read the\n   raw error to identify the failure mode.\n2. Correlate with disk telemetry: the `Perf` table carries Logical Disk `% Used Space` and\n   `Free Megabytes` for the worker. A data volume (`\u002Fdata`) at ~100% used \u002F near-zero free is the\n   signal that the export writes are failing for lack of space.\n3. Confirm on the VM with a read command (`az vm run-command invoke ... --scripts \"df -h \u002Fdata\"`).\n4. Mitigate live: free space on the worker's data disk (remove the accumulated backlog file under\n   `\u002Fdata\u002Fexports`) via `az vm run-command`. Re-check that the next export run logs a success heartbeat.\n5. Durable fix: the worker's export retention\u002Frotation lives in `src\u002Freporting-worker\u002Fcloud-init.yaml`\n   — a PR that enforces retention (or grows the data disk in `infra\u002Fmodules\u002Fvm.bicep`) is the lasting fix.\n\n## Database-backed quiz lanes (slow loading \u002F errors under load \u002F auth failures)\nThe quiz lanes read PostgreSQL on the request path, so a DB fault produces app-shaped symptoms on a\nclean edge + healthy replicas. Do NOT stop at \"the DB looks slow\" and report root cause unknown —\nidentify WHICH database surface — log-first, confirm from the lane's error `detail`, then optionally\nverify in the database:\n1. Read the quiz service's console logs (`ContainerAppConsoleLogs_CL` for the failing `quiz-*` app \u002F\n   `assessment-api`) for the request shape: a slow `ms=\u003Cduration>` on `\u002Fquiz\u002F*` → index\u002Flatency;\n   a burst of `status=500` on `\u002Fquiz\u002F*` (and any `pool error:` lines) → a backend DB failure.\n2. Get the EXACT backend error straight from the lane — the service returns the underlying Postgres\n   error in the response `detail` field (it is NOT written to the logs): `curl` the lane's `\u002Fhealth`\n   (returns `503 {\"status\":\"degraded\",\"detail\":\"\u003Cpg error>\"}` when the DB path is broken) or\n   `\u002Fquiz\u002F\u003CcourseId>` (`500 {\"error\":\"...\",\"detail\":\"\u003Cpg error>\"}`). The `detail` names the cause\n   directly — e.g. `password authentication failed` (28P01) → bad DB secret; `too many connections`\n   \u002F `remaining connection slots` \u002F connection-limit → pool exhaustion; a slow-but-200 `\u002Fquiz` with\n   climbing `ms=` → missing index. This needs no DB credentials and is the primary confirmation.\n3. Optionally confirm against the database itself with a read-only query (connection recipe in the\n   knowledge base — server\u002Flogin from `az postgres flexible-server list`, admin password from Key\n   Vault `db-password`, then `az postgres flexible-server execute --querytext \"\u003CSQL>\"`):\n   - **Slow quiz loading (query lane, db `zava_query`):** check the `question_bank` indexes —\n     `SELECT indexname FROM pg_indexes WHERE tablename='question_bank';` and\n     `SELECT relname,seq_scan,idx_scan FROM pg_stat_user_tables WHERE relname='question_bank';`.\n     A missing index on `question_bank` with seq-scans climbing is the root cause; the durable fix is\n     to (re)build it (REINDEX\u002FCREATE INDEX) — delivered as a PR.\n   - **Errors under load (pool lane, db `zava`):** check the connecting role's connection limit —\n     `SELECT rolname,rolconnlimit FROM pg_roles WHERE rolname='app_pool';` and live connections in\n     `pg_stat_activity`. A `rolconnlimit` of 1 (or far below the pool size) is the root cause; restore\n     a sane limit (`ALTER ROLE app_pool CONNECTION LIMIT \u003Cn>`).\n   - **Authentication errors (secret lane):** the lane's Key Vault DB secret (`db-password-secretlane`)\n     was rotated to an invalid value — confirm the auth-failure log signature; the fix is to **restore a\n     valid value INTO `db-password-secretlane`** (copy it from the baseline `db-password` secret with\n     `az keyvault secret set`) and then force the lane to re-read it by **creating a NEW revision**\n     (`az containerapp update --set-env-vars FORCE_ROTATE=\u003Ctimestamp>`). A plain `az containerapp\n     revision restart` is NOT enough — Container Apps resolve Key Vault secret references at\n     revision-creation time, so a restart reuses the cached (still-invalid) value; only a new revision\n     re-reads the secret. Then re-check the lane returns 200. Do **NOT** run `az containerapp secret set` \u002F\n     re-assert the secret's `identityref` (unnecessary — the reference is already correct), and do **NOT**\n     repoint `pg-password` to a different Key Vault secret (e.g. the shared `db-password`) — that masks the\n     fault and breaks lane isolation; only the `db-password-secretlane` **value** should change.\n4. Mitigate live with the smallest corrective action (rebuild the index \u002F restore the connection limit\n   \u002F restore the secret), re-check the lane returns 200, then deliver the durable fix as a PR.\nBase the RCA on the confirmed surface above — DB-internal faults must resolve to a named cause (index,\nconnection limit, or secret), never \"root cause unknown.\"\n\n## Permitted autonomous actions\n- Restore replica counts \u002F restart a Container Apps revision.\n- Reactivate a deactivated revision (`az containerapp revision activate`) to bring back zero-replica lanes.\n- Roll back to the last-known-good revision.\n- Free space on the reporting-worker VM's data disk (remove an accumulated backlog file under `\u002Fdata`).\n\n## Code fix\nIf the root cause is in application source, the app code lives under `src\u002F` in `@@REPO@@`. After\nthe live mitigation (revision rollback\u002Frestart), the durable code fix is delivered as a GitHub PR\nby the `pr-delivery` skill and recorded as a Change Request by `servicenow-change-management`.\n\n## Incident communication\nPagerDuty acknowledgement, status\u002Fsummary notes, and resolution are owned by the\n`pagerduty-incident-update` skill.\n\n## Verification\nConfirm `\u002Fapi\u002Fquiz\u002F*` returns 200 and the API success rate is back to baseline.\n",{"name":5,"tools":56,"metadata":64,"description":7},[57,58,59,60,61,62,63],"RunAzCliReadCommands","RunAzCliWriteCommands","GetAzCliHelp","SearchMemory","ExecutePythonCode","microsoft-learn_microsoft_docs_search","microsoft-learn_microsoft_docs_fetch",{"kind":65,"api_version":66},"Skill","azuresre.ai\u002Fv2","main","f3dccc6bae8c932ff4f21e6d4117e14285da4db3","labs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fperformance-investigation",198,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-10 10:20:55",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add microsoft\u002Fsre-agent --skill performance-investigation",{"tool":82,"command":83},"bunx","bunx skills add microsoft\u002Fsre-agent --skill performance-investigation",{"tool":85,"command":86},"pnpm","pnpm dlx skills add microsoft\u002Fsre-agent --skill performance-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fperformance-investigation\u002FSKILL.md",true,[],[91,119,152,174,200,216],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":51},"01M699ZY06GBDPEYW1HEDRAVK8","zava-reporting","Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before\u002Fafter visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-reporting\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118],"zava reporting","reporting","rca","visuals","powerpoint","executive summary","analysis","markdown","html report","template","html","only","evidence","before-after","next","delivery","incident","recommendations","present","inline","send",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":134,"publishedAt":51},"01M699ZWCMAF3M8P4A8P0VXEF7","zava-audit-report","Use to package a completed Zava Learning weekly governance audit (NSG \u002F network security, RBAC \u002F least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-audit-report\u002FSKILL.md",[125,128,131],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":132,"categoryName":133,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000034","行政与办公人员",[135,136,137,138,139,140,141,102,142,143,144,44,145,146,147,148,149,150,118,151],"zava audit report","report","audit","audit report","security","network security","rbac","network","least-privilege","severity","returns","short","list","deck","artifact","weekly","single",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":51},"01M699ZV3DK2HK74MMKABQBNC7","servicenow-change-management","Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fservicenow-change-management\u002FSKILL.md",[],[159,160,161,162,163,164,100,165,166,167,44,168,42,169,170,171,172,34,151,173],"change","servicenow change management","servicenow","change management","management","github","pr","code","infrastructure-as-code","fix","attach","github pr","as","infrastructure-as","root cause",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":51},"01M699ZSQAYXNM5YXH35GQXG2E","redaction-guard","Use whenever you are about to emit operator-visible content — a chat\u002Fthread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fredaction-guard\u002FSKILL.md",[],[181,182,183,184,185,186,187,188,189,42,190,191,192,193,194,195,196,197,198,199],"redaction guard","guard","redaction","commit","teams","commit message","pull","runbook","pii","never","pagerduty","chat","tokens","guardrail","card","output","you","passwords","thread",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":51},"01M699ZRHD3XNYX412M7613ACM","recommendations-next-steps","Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frecommendations-next-steps\u002FSKILL.md",[],[207,112,115,208,33,9,49,209,47,210,99,211,44,212,42,114,196,213,214,34,215],"recommendations next steps","next steps","produce","actions","risk","process","with","deliverables","dates",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":222,"publishedAt":51},"01M699ZQBV3ECBCA58WSBCJE54","rca-analysis","Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before\u002Fafter, recommendations, and reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frca-analysis\u002FSKILL.md",[],[100,223,104,209,224,225,44,226,42,227,114,115,228,229,230,196,214,34,231,173],"rca analysis","contributing","how","format","root-cause","trigger","how to","narrative","section"]