claude-flow-novice 2.3.5 → 2.3.6

package/dist/scripts/monitoring/alert-monitor.sh

@@ -1,220 +0,0 @@
-#!/usr/bin/env bash
-# scripts/monitoring/alert-monitor.sh - Continuous monitoring daemon with alerting
-# Phase 1 Sprint 1.1: Monitoring loop integration
-
-set -euo pipefail
-
-# ==============================================================================
-# CONFIGURATION
-# ==============================================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-LIB_DIR="${SCRIPT_DIR}/../../lib"
-METRICS_FILE="${METRICS_FILE:-/dev/shm/cfn-metrics.jsonl}"
-ALERT_LOG_FILE="${ALERT_LOG_FILE:-/dev/shm/cfn-alerts.jsonl}"
-MONITOR_PID_FILE="${MONITOR_PID_FILE:-/dev/shm/alert-monitor.pid}"
-
-# Check interval (seconds)
-CHECK_INTERVAL="${CHECK_INTERVAL:-30}"
-
-# Cleanup retention (hours)
-ALERT_RETENTION_HOURS="${ALERT_RETENTION_HOURS:-24}"
-METRICS_RETENTION_HOURS="${METRICS_RETENTION_HOURS:-48}"
-
-# ==============================================================================
-# DEPENDENCIES
-# ==============================================================================
-
-# Source alerting library
-if [ -f "$LIB_DIR/alerting.sh" ]; then
-  # shellcheck source=../../lib/alerting.sh
-  source "$LIB_DIR/alerting.sh"
-else
-  echo "[ERROR] Alerting library not found at $LIB_DIR/alerting.sh" >&2
-  exit 1
-fi
-
-# ==============================================================================
-# SIGNAL HANDLERS
-# ==============================================================================
-
-cleanup() {
-  echo "[INFO] Shutting down alert monitor (PID: $$)" >&2
-  rm -f "$MONITOR_PID_FILE"
-  exit 0
-}
-
-trap cleanup SIGTERM SIGINT
-
-# ==============================================================================
-# MONITORING FUNCTIONS
-# ==============================================================================
-
-# start_monitor - Begin continuous threshold monitoring
-start_monitor() {
-  local iteration=0
-
-  echo "[INFO] Alert monitor started (PID: $$)" >&2
-  echo "[INFO] Check interval: ${CHECK_INTERVAL}s" >&2
-  echo "[INFO] Metrics file: $METRICS_FILE" >&2
-  echo "[INFO] Alert log: $ALERT_LOG_FILE" >&2
-
-  # Write PID file
-  echo $$ > "$MONITOR_PID_FILE"
-
-  while true; do
-    iteration=$((iteration + 1))
-
-    # Check thresholds
-    if [ -f "$METRICS_FILE" ]; then
-      check_thresholds "$METRICS_FILE" 2>&1 | while IFS= read -r line; do
-        echo "[$(date -u +"%Y-%m-%dT%H:%M:%SZ")] $line"
-      done
-    fi
-
-    # Periodic cleanup (every 100 iterations)
-    if [ $((iteration % 100)) -eq 0 ]; then
-      echo "[INFO] Running periodic cleanup (iteration $iteration)" >&2
-      cleanup_old_data
-    fi
-
-    # Sleep until next check
-    sleep "$CHECK_INTERVAL"
-  done
-}
-
-# cleanup_old_data - Remove old metrics and alerts
-cleanup_old_data() {
-  # Clear old alerts
-  if [ -f "$ALERT_LOG_FILE" ]; then
-    local alert_count_before
-    alert_count_before=$(wc -l < "$ALERT_LOG_FILE" 2>/dev/null || echo "0")
-
-    clear_old_alerts "$ALERT_RETENTION_HOURS"
-
-    local alert_count_after
-    alert_count_after=$(wc -l < "$ALERT_LOG_FILE" 2>/dev/null || echo "0")
-
-    echo "[INFO] Cleared $((alert_count_before - alert_count_after)) old alerts" >&2
-  fi
-
-  # Clear old metrics
-  if [ -f "$METRICS_FILE" ]; then
-    local metrics_count_before
-    metrics_count_before=$(wc -l < "$METRICS_FILE" 2>/dev/null || echo "0")
-
-    local cutoff_time
-    cutoff_time=$(date -u -d "$METRICS_RETENTION_HOURS hours ago" +"%Y-%m-%dT%H:%M:%S" 2>/dev/null || \
-                  date -u -v-"${METRICS_RETENTION_HOURS}H" +"%Y-%m-%dT%H:%M:%S" 2>/dev/null || \
-                  echo "1970-01-01T00:00:00")
-
-    local temp_file="${METRICS_FILE}.tmp"
-    jq -c --arg cutoff "$cutoff_time" \
-      'select(.timestamp >= $cutoff)' \
-      "$METRICS_FILE" > "$temp_file" 2>/dev/null || true
-
-    if [ -f "$temp_file" ]; then
-      mv "$temp_file" "$METRICS_FILE"
-
-      local metrics_count_after
-      metrics_count_after=$(wc -l < "$METRICS_FILE" 2>/dev/null || echo "0")
-
-      echo "[INFO] Cleared $((metrics_count_before - metrics_count_after)) old metrics" >&2
-    fi
-  fi
-}
-
-# get_monitor_status - Check if monitor is running
-get_monitor_status() {
-  if [ -f "$MONITOR_PID_FILE" ]; then
-    local pid
-    pid=$(cat "$MONITOR_PID_FILE")
-
-    if kill -0 "$pid" 2>/dev/null; then
-      echo "running (PID: $pid)"
-      return 0
-    else
-      echo "stale (PID file exists but process not running)"
-      rm -f "$MONITOR_PID_FILE"
-      return 1
-    fi
-  else
-    echo "stopped"
-    return 1
-  fi
-}
-
-# stop_monitor - Stop running monitor
-stop_monitor() {
-  if [ -f "$MONITOR_PID_FILE" ]; then
-    local pid
-    pid=$(cat "$MONITOR_PID_FILE")
-
-    if kill -0 "$pid" 2>/dev/null; then
-      echo "[INFO] Stopping monitor (PID: $pid)" >&2
-      kill -TERM "$pid"
-
-      # Wait for graceful shutdown (max 5 seconds)
-      for i in {1..10}; do
-        if ! kill -0 "$pid" 2>/dev/null; then
-          echo "[INFO] Monitor stopped successfully" >&2
-          return 0
-        fi
-        sleep 0.5
-      done
-
-      # Force kill if still running
-      if kill -0 "$pid" 2>/dev/null; then
-        echo "[WARN] Monitor did not stop gracefully, forcing..." >&2
-        kill -KILL "$pid" 2>/dev/null || true
-      fi
-    fi
-
-    rm -f "$MONITOR_PID_FILE"
-  else
-    echo "[INFO] No monitor running" >&2
-  fi
-}
-
-# ==============================================================================
-# MAIN EXECUTION
-# ==============================================================================
-
-case "${1:-start}" in
-  start)
-    if [ -f "$MONITOR_PID_FILE" ]; then
-      echo "[ERROR] Monitor already running (PID: $(cat "$MONITOR_PID_FILE"))" >&2
-      exit 1
-    fi
-    start_monitor
-    ;;
-
-  stop)
-    stop_monitor
-    ;;
-
-  restart)
-    stop_monitor
-    sleep 1
-    start_monitor
-    ;;
-
-  status)
-    get_monitor_status
-    ;;
-
-  background)
-    # Start in background
-    if [ -f "$MONITOR_PID_FILE" ]; then
-      echo "[ERROR] Monitor already running (PID: $(cat "$MONITOR_PID_FILE"))" >&2
-      exit 1
-    fi
-    nohup "$0" start > /dev/shm/alert-monitor.log 2>&1 &
-    echo "[INFO] Monitor started in background (PID: $!)" >&2
-    ;;
-
-  *)
-    echo "Usage: $0 {start|stop|restart|status|background}" >&2
-    exit 1
-    ;;
-esac

package/dist/scripts/monitoring/analyze-resources.sh

@@ -1,199 +0,0 @@
-#!/bin/bash
-# Analysis script for resource monitoring results
-# Identifies leaks, spikes, and anomalies
-
-set -euo pipefail
-
-CSV_FILE="${1:-}"
-
-if [ -z "${CSV_FILE}" ] || [ ! -f "${CSV_FILE}" ]; then
-    echo "Usage: $0 <csv_file>"
-    echo "Example: $0 ./reports/monitoring/resource-usage-20250106_120000.csv"
-    exit 1
-fi
-
-OUTPUT_DIR=$(dirname "${CSV_FILE}")
-REPORT_FILE="${OUTPUT_DIR}/analysis-report-$(date +%Y%m%d_%H%M%S).txt"
-
-echo "========================================" | tee "${REPORT_FILE}"
-echo "RESOURCE MONITORING ANALYSIS REPORT" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "Input: ${CSV_FILE}" | tee -a "${REPORT_FILE}"
-echo "Generated: $(date)" | tee -a "${REPORT_FILE}"
-echo "" | tee -a "${REPORT_FILE}"
-
-# Skip header, get data
-DATA=$(tail -n +2 "${CSV_FILE}")
-
-if [ -z "${DATA}" ]; then
-    echo "ERROR: No data found in CSV file" | tee -a "${REPORT_FILE}"
-    exit 1
-fi
-
-# Total samples
-TOTAL_SAMPLES=$(echo "${DATA}" | wc -l)
-echo "Total Samples: ${TOTAL_SAMPLES}" | tee -a "${REPORT_FILE}"
-
-# Duration
-FIRST_ELAPSED=$(echo "${DATA}" | head -1 | cut -d',' -f2)
-LAST_ELAPSED=$(echo "${DATA}" | tail -1 | cut -d',' -f2)
-DURATION=$((LAST_ELAPSED - FIRST_ELAPSED))
-echo "Duration: ${DURATION} seconds" | tee -a "${REPORT_FILE}"
-echo "" | tee -a "${REPORT_FILE}"
-
-# Memory RSS analysis
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "MEMORY (RSS) ANALYSIS" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-
-MEMORY_RSS_VALUES=$(echo "${DATA}" | cut -d',' -f3)
-MEMORY_RSS_MIN=$(echo "${MEMORY_RSS_VALUES}" | sort -n | head -1)
-MEMORY_RSS_MAX=$(echo "${MEMORY_RSS_VALUES}" | sort -n | tail -1)
-MEMORY_RSS_AVG=$(echo "${MEMORY_RSS_VALUES}" | awk '{sum+=$1; count++} END {printf "%.2f", sum/count}')
-
-MEMORY_RSS_FIRST=$(echo "${MEMORY_RSS_VALUES}" | head -1)
-MEMORY_RSS_LAST=$(echo "${MEMORY_RSS_VALUES}" | tail -1)
-MEMORY_RSS_GROWTH=$(echo "scale=2; ${MEMORY_RSS_LAST} - ${MEMORY_RSS_FIRST}" | bc)
-MEMORY_RSS_GROWTH_RATE=$(echo "scale=4; ${MEMORY_RSS_GROWTH} / ${DURATION}" | bc 2>/dev/null || echo "0")
-
-echo "Min: ${MEMORY_RSS_MIN} MB" | tee -a "${REPORT_FILE}"
-echo "Max: ${MEMORY_RSS_MAX} MB" | tee -a "${REPORT_FILE}"
-echo "Avg: ${MEMORY_RSS_AVG} MB" | tee -a "${REPORT_FILE}"
-echo "First: ${MEMORY_RSS_FIRST} MB" | tee -a "${REPORT_FILE}"
-echo "Last: ${MEMORY_RSS_LAST} MB" | tee -a "${REPORT_FILE}"
-echo "Growth: ${MEMORY_RSS_GROWTH} MB" | tee -a "${REPORT_FILE}"
-echo "Growth Rate: ${MEMORY_RSS_GROWTH_RATE} MB/sec" | tee -a "${REPORT_FILE}"
-
-# Memory leak detection (growth rate > 1 MB/sec)
-if (( $(echo "${MEMORY_RSS_GROWTH_RATE} > 1.0" | bc -l 2>/dev/null || echo 0) )); then
-    echo "⚠️  LEAK DETECTED: Memory growing at ${MEMORY_RSS_GROWTH_RATE} MB/sec" | tee -a "${REPORT_FILE}"
-elif (( $(echo "${MEMORY_RSS_GROWTH_RATE} > 0.1" | bc -l 2>/dev/null || echo 0) )); then
-    echo "⚠️  WARNING: Slow memory growth detected (${MEMORY_RSS_GROWTH_RATE} MB/sec)" | tee -a "${REPORT_FILE}"
-else
-    echo "✅ No significant memory leak detected" | tee -a "${REPORT_FILE}"
-fi
-echo "" | tee -a "${REPORT_FILE}"
-
-# CPU analysis
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "CPU ANALYSIS" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-
-CPU_VALUES=$(echo "${DATA}" | cut -d',' -f6)
-CPU_MIN=$(echo "${CPU_VALUES}" | sort -n | head -1)
-CPU_MAX=$(echo "${CPU_VALUES}" | sort -n | tail -1)
-CPU_AVG=$(echo "${CPU_VALUES}" | awk '{sum+=$1; count++} END {printf "%.2f", sum/count}')
-
-echo "Min: ${CPU_MIN}%" | tee -a "${REPORT_FILE}"
-echo "Max: ${CPU_MAX}%" | tee -a "${REPORT_FILE}"
-echo "Avg: ${CPU_AVG}%" | tee -a "${REPORT_FILE}"
-
-# CPU spike detection (>80% sustained for >5 samples)
-CPU_SPIKES=$(echo "${CPU_VALUES}" | awk '{if ($1 > 80) count++} END {print count}')
-if [ "${CPU_SPIKES}" -gt 5 ]; then
-    echo "⚠️  CPU SPIKES: ${CPU_SPIKES} samples above 80%" | tee -a "${REPORT_FILE}"
-else
-    echo "✅ No sustained CPU spikes detected" | tee -a "${REPORT_FILE}"
-fi
-echo "" | tee -a "${REPORT_FILE}"
-
-# File descriptor analysis
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "FILE DESCRIPTOR ANALYSIS" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-
-FD_VALUES=$(echo "${DATA}" | cut -d',' -f7)
-FD_MIN=$(echo "${FD_VALUES}" | sort -n | head -1)
-FD_MAX=$(echo "${FD_VALUES}" | sort -n | tail -1)
-FD_AVG=$(echo "${FD_VALUES}" | awk '{sum+=$1; count++} END {printf "%.0f", sum/count}')
-
-FD_FIRST=$(echo "${FD_VALUES}" | head -1)
-FD_LAST=$(echo "${FD_VALUES}" | tail -1)
-FD_GROWTH=$((FD_LAST - FD_FIRST))
-
-echo "Min: ${FD_MIN}" | tee -a "${REPORT_FILE}"
-echo "Max: ${FD_MAX}" | tee -a "${REPORT_FILE}"
-echo "Avg: ${FD_AVG}" | tee -a "${REPORT_FILE}"
-echo "First: ${FD_FIRST}" | tee -a "${REPORT_FILE}"
-echo "Last: ${FD_LAST}" | tee -a "${REPORT_FILE}"
-echo "Growth: ${FD_GROWTH}" | tee -a "${REPORT_FILE}"
-
-# FD leak detection (growth > 100)
-if [ "${FD_GROWTH}" -gt 100 ]; then
-    echo "⚠️  FD LEAK DETECTED: ${FD_GROWTH} unclosed file descriptors" | tee -a "${REPORT_FILE}"
-elif [ "${FD_GROWTH}" -gt 20 ]; then
-    echo "⚠️  WARNING: FD growth detected (${FD_GROWTH})" | tee -a "${REPORT_FILE}"
-else
-    echo "✅ No significant FD leak detected" | tee -a "${REPORT_FILE}"
-fi
-echo "" | tee -a "${REPORT_FILE}"
-
-# Process count analysis
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "PROCESS COUNT ANALYSIS" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-
-PROC_VALUES=$(echo "${DATA}" | cut -d',' -f8)
-PROC_MIN=$(echo "${PROC_VALUES}" | sort -n | head -1)
-PROC_MAX=$(echo "${PROC_VALUES}" | sort -n | tail -1)
-PROC_AVG=$(echo "${PROC_VALUES}" | awk '{sum+=$1; count++} END {printf "%.0f", sum/count}')
-
-PROC_FIRST=$(echo "${PROC_VALUES}" | head -1)
-PROC_LAST=$(echo "${PROC_VALUES}" | tail -1)
-PROC_GROWTH=$((PROC_LAST - PROC_FIRST))
-
-echo "Min: ${PROC_MIN}" | tee -a "${REPORT_FILE}"
-echo "Max: ${PROC_MAX}" | tee -a "${REPORT_FILE}"
-echo "Avg: ${PROC_AVG}" | tee -a "${REPORT_FILE}"
-echo "First: ${PROC_FIRST}" | tee -a "${REPORT_FILE}"
-echo "Last: ${PROC_LAST}" | tee -a "${REPORT_FILE}"
-echo "Growth: ${PROC_GROWTH}" | tee -a "${REPORT_FILE}"
-
-# Process leak detection (growth > 50)
-if [ "${PROC_GROWTH}" -gt 50 ]; then
-    echo "⚠️  PROCESS LEAK DETECTED: ${PROC_GROWTH} orphaned processes" | tee -a "${REPORT_FILE}"
-elif [ "${PROC_GROWTH}" -gt 10 ]; then
-    echo "⚠️  WARNING: Process growth detected (${PROC_GROWTH})" | tee -a "${REPORT_FILE}"
-else
-    echo "✅ No significant process leak detected" | tee -a "${REPORT_FILE}"
-fi
-echo "" | tee -a "${REPORT_FILE}"
-
-# Anomaly summary
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "ANOMALY SUMMARY" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-
-ANOMALY_COUNT=0
-
-if (( $(echo "${MEMORY_RSS_GROWTH_RATE} > 0.1" | bc -l 2>/dev/null || echo 0) )); then
-    echo "• Memory growth: ${MEMORY_RSS_GROWTH_RATE} MB/sec" | tee -a "${REPORT_FILE}"
-    ANOMALY_COUNT=$((ANOMALY_COUNT + 1))
-fi
-
-if [ "${CPU_SPIKES}" -gt 5 ]; then
-    echo "• CPU spikes: ${CPU_SPIKES} samples above 80%" | tee -a "${REPORT_FILE}"
-    ANOMALY_COUNT=$((ANOMALY_COUNT + 1))
-fi
-
-if [ "${FD_GROWTH}" -gt 20 ]; then
-    echo "• FD growth: ${FD_GROWTH}" | tee -a "${REPORT_FILE}"
-    ANOMALY_COUNT=$((ANOMALY_COUNT + 1))
-fi
-
-if [ "${PROC_GROWTH}" -gt 10 ]; then
-    echo "• Process growth: ${PROC_GROWTH}" | tee -a "${REPORT_FILE}"
-    ANOMALY_COUNT=$((ANOMALY_COUNT + 1))
-fi
-
-if [ "${ANOMALY_COUNT}" -eq 0 ]; then
-    echo "✅ No anomalies detected - system healthy" | tee -a "${REPORT_FILE}"
-else
-    echo "" | tee -a "${REPORT_FILE}"
-    echo "⚠️  Total anomalies: ${ANOMALY_COUNT}" | tee -a "${REPORT_FILE}"
-fi
-
-echo "" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"
-echo "Report saved: ${REPORT_FILE}" | tee -a "${REPORT_FILE}"
-echo "========================================" | tee -a "${REPORT_FILE}"

package/dist/scripts/monitoring/dashboards/rate-limiting-dashboard.json

@@ -1,211 +0,0 @@
-{
-  "dashboard": {
-    "title": "CFN Rate Limiting & Backpressure Monitoring",
-    "description": "Real-time monitoring of message inbox utilization, backpressure events, and overflow alerts",
-    "version": "1.0.0",
-    "tags": ["rate-limiting", "backpressure", "inbox", "coordination"],
-    "timezone": "UTC",
-    "refresh": "10s",
-    "panels": [
-      {
-        "id": 1,
-        "title": "Inbox Utilization by Agent",
-        "type": "timeseries",
-        "gridPos": { "x": 0, "y": 0, "w": 12, "h": 8 },
-        "targets": [
-          {
-            "metric": "inbox.utilization",
-            "legend": "{{agent}}",
-            "unit": "percent"
-          }
-        ],
-        "thresholds": [
-          { "value": 75, "color": "yellow", "label": "Warning" },
-          { "value": 90, "color": "red", "label": "Critical" }
-        ],
-        "description": "Message inbox utilization percentage per agent (max 100 messages)"
-      },
-      {
-        "id": 2,
-        "title": "Inbox Message Count",
-        "type": "timeseries",
-        "gridPos": { "x": 12, "y": 0, "w": 12, "h": 8 },
-        "targets": [
-          {
-            "metric": "inbox.size",
-            "legend": "{{agent}}",
-            "unit": "count"
-          }
-        ],
-        "thresholds": [
-          { "value": 75, "color": "yellow", "label": "Warning (75 msgs)" },
-          { "value": 90, "color": "red", "label": "Critical (90 msgs)" }
-        ],
-        "description": "Absolute message count in agent inboxes"
-      },
-      {
-        "id": 3,
-        "title": "Backpressure Events Rate",
-        "type": "timeseries",
-        "gridPos": { "x": 0, "y": 8, "w": 12, "h": 8 },
-        "targets": [
-          {
-            "metric": "backpressure.events_per_min",
-            "legend": "Backpressure events/min",
-            "unit": "count"
-          }
-        ],
-        "thresholds": [
-          { "value": 100, "color": "yellow", "label": "Warning threshold" }
-        ],
-        "description": "Rate of backpressure wait events (high rate indicates system load)"
-      },
-      {
-        "id": 4,
-        "title": "Message Send Failures",
-        "type": "timeseries",
-        "gridPos": { "x": 12, "y": 8, "w": 12, "h": 8 },
-        "targets": [
-          {
-            "metric": "coordination.send_failures_per_min",
-            "legend": "Send failures/min",
-            "unit": "count"
-          }
-        ],
-        "thresholds": [
-          { "value": 10, "color": "red", "label": "Critical threshold" }
-        ],
-        "description": "Message delivery failure rate (critical if >10/min)"
-      },
-      {
-        "id": 5,
-        "title": "Inbox Overflow Events",
-        "type": "timeseries",
-        "gridPos": { "x": 0, "y": 16, "w": 12, "h": 8 },
-        "targets": [
-          {
-            "metric": "inbox.overflow_events_per_min",
-            "legend": "Overflow events/min",
-            "unit": "count"
-          }
-        ],
-        "thresholds": [
-          { "value": 1, "color": "red", "label": "Any overflow is critical" }
-        ],
-        "description": "Inbox overflow events (messages dropped due to full inbox)"
-      },
-      {
-        "id": 6,
-        "title": "Alert Summary",
-        "type": "stat",
-        "gridPos": { "x": 12, "y": 16, "w": 6, "h": 8 },
-        "targets": [
-          {
-            "query": "count_alerts_by_severity",
-            "fields": ["critical", "warning", "info"]
-          }
-        ],
-        "description": "Alert counts by severity level (last hour)"
-      },
-      {
-        "id": 7,
-        "title": "Top Utilized Agents",
-        "type": "table",
-        "gridPos": { "x": 18, "y": 16, "w": 6, "h": 8 },
-        "targets": [
-          {
-            "query": "top_inbox_utilization",
-            "fields": ["agent", "utilization", "message_count"],
-            "limit": 10,
-            "order": "desc"
-          }
-        ],
-        "description": "Agents with highest inbox utilization"
-      }
-    ],
-    "annotations": [
-      {
-        "name": "Rate Limiting Alerts",
-        "datasource": "cfn-alerts",
-        "filter": {
-          "tags": ["inbox_high_utilization", "backpressure_high_rate", "inbox_overflow_detected"]
-        },
-        "color": "red"
-      }
-    ],
-    "variables": [
-      {
-        "name": "agent",
-        "type": "query",
-        "query": "SELECT DISTINCT agent FROM inbox_metrics",
-        "description": "Filter by specific agent",
-        "multi": true,
-        "includeAll": true
-      },
-      {
-        "name": "timeRange",
-        "type": "interval",
-        "options": ["5m", "15m", "1h", "6h", "24h"],
-        "default": "1h",
-        "description": "Time range for metrics"
-      }
-    ]
-  },
-  "queries": {
-    "count_alerts_by_severity": {
-      "description": "Count alerts grouped by severity",
-      "source": "/dev/shm/cfn-alerts.jsonl",
-      "aggregation": "GROUP BY severity, COUNT(*)",
-      "timeWindow": "1h"
-    },
-    "top_inbox_utilization": {
-      "description": "Rank agents by inbox utilization",
-      "source": "/dev/shm/cfn-metrics.jsonl",
-      "query": "SELECT agent, MAX(value) as utilization FROM metrics WHERE metric='inbox.utilization' GROUP BY agent ORDER BY utilization DESC LIMIT 10",
-      "timeWindow": "5m"
-    }
-  },
-  "alertRules": [
-    {
-      "name": "Inbox Critical Utilization",
-      "condition": "inbox.utilization >= 90",
-      "severity": "critical",
-      "message": "Agent {{agent}} inbox at {{value}}% utilization (critical threshold: 90%)",
-      "actions": ["emit_alert", "notify_oncall"]
-    },
-    {
-      "name": "Inbox Warning Utilization",
-      "condition": "inbox.utilization >= 75 AND inbox.utilization < 90",
-      "severity": "warning",
-      "message": "Agent {{agent}} inbox at {{value}}% utilization (warning threshold: 75%)",
-      "actions": ["emit_alert"]
-    },
-    {
-      "name": "Backpressure High Rate",
-      "condition": "backpressure.events_per_min > 100",
-      "severity": "warning",
-      "message": "Backpressure events exceeding threshold: {{value}} events/min (threshold: 100/min)",
-      "actions": ["emit_alert"]
-    },
-    {
-      "name": "Message Send Failures Critical",
-      "condition": "coordination.send_failures_per_min > 10",
-      "severity": "critical",
-      "message": "Message send failures critical: {{value}} failures/min (threshold: 10/min)",
-      "actions": ["emit_alert", "notify_oncall", "trigger_incident"]
-    },
-    {
-      "name": "Inbox Overflow Detected",
-      "condition": "inbox.overflow_events_per_min > 0",
-      "severity": "critical",
-      "message": "Inbox overflow detected: {{value}} overflow events in last minute",
-      "actions": ["emit_alert", "notify_oncall", "trigger_incident"]
-    }
-  ],
-  "metadata": {
-    "createdBy": "devops-engineer",
-    "phase": "1",
-    "sprint": "1.5",
-    "lastUpdated": "2025-10-06T19:35:00Z"
-  }
-}