datadog-observability

Install observability-core alongside this. The core writes every procedure against capabilities — an error aggregator, a metrics store, a deploy log, an incident record — and asks you to map them once per environment. This plugin is that mapping, filled in for Datadog, plus the queries. The judgement stays in the core: nothing here changes when to declare or how severity is chosen.

Datadog fills four of the six capabilities, where a cloud-native stack fills three, because it has a real incident-management product. That advantage has a cost worth stating: having the incident record beside the evidence removes the usual excuse for declaring late, but it introduces a failure the cloud adapters cannot have — an incident that exists, is linked from everywhere, and is empty, which reads a quarter later exactly like no incident at all.

The query skill is built around the things that quietly change what a number means: rollup interval, space aggregation, the difference between a tag and a log attribute, and exclusion filters that make a real count not the population. An error rate whose denominator is scoped differently from its numerator is arithmetic on unrelated numbers, and it looks plausible.

Triage produces a ranked, deduplicated proposal set and stops. Filing belongs to a tracker adapter — pair it with jira-tracker or github-issues. The dd-investigator subagent answers one bounded question read-only and never mutates: no muting, no downtime, no resolving.