Observal OpsSAFE

Observal is self-hosted registry for your coding agent extensions with a built in insight engine. Setup Observal, define the scope and share your Skills, MCPs and Agents with your peers.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
# SPDX-FileCopyrightText: 2026 Hemalatha Madeswaran <[email protected]>
# SPDX-License-Identifier: Apache-2.0
name: observal-ops
command: observal
description: "Inspects Observal traces, sessions, rankings, feedback, telemetry health, logs, and Agent insight reports. Use when the user wants operational evidence, current activity, telemetry diagnosis, ratings, report generation, regression analysis, or recommendations grounded in Agent usage."
version: 2.4.0
owner: observal
---

# Observing Observal

## Execution contract

1. Execute commands with a 60 second timeout. Use a longer timeout only for report generation or an intentional stream.
2. **Use machine output by default:** add `--output json` whenever supported. Parse list envelopes, finite objects, and JSON Lines separately.
3. Run `--help` before acting when a path or flag is uncertain.
4. Start with the narrowest read that answers the question. Do not generate a new report when a completed report already suffices.
5. Ground every conclusion in returned fields, report period, and sample size. Distinguish missing data from healthy data.
6. Verify rating mutations and report generation results.
7. Never repeat secrets or sensitive trace and log content unless the user explicitly requests the specific data and is authorized.
8. After an uncertain rating or report-generation failure, read current state before retrying.

## Choose the workflow

| User intent | Read |
| --- | --- |
| Sessions, traces, rankings, ratings, telemetry, or logs | [Operational workflows](references/operational-workflows.md) |
| Agent health, friction, costs, versions, regressions, or suggestions | [Insight reports](references/insight-reports.md) |

Read the selected reference completely before executing.

## Analysis rules

- A zero exit status from telemetry diagnosis can still contain issues or warnings. Read the JSON health fields.
- No events is not automatically a hook problem. Check authentication, server reachability, local outbox, and hook state in that order.
- Quote report evidence accurately and say when session count is thin.
- Only `component_ref` proves an insight suggestion maps to a Registry component. Never reconstruct a component identity from prose.
- Lead with reuse suggestions before create-new suggestions.
- For logs and traces, summarize the minimum sensitive content needed to answer the question.

## Completion

Report the time range, filters, counts, health state, strongest evidence, uncertainty, and concrete next action. Do not present popularity fallback or sparse reports as personalized certainty.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.