Distributed Trace Analysis

Distributed Trace Analysis

When to Use

• Use this skill when you need to use traces, spans, and topology to locate cross-service latency, error propagation, and dependency failures.
• Use it to review an existing plan, result, or evidence set and produce actionable improvements.
• Use it when context is incomplete but a bounded first pass is still valuable.

Output Format Options

• Default to Markdown for review, execution, and incremental refinement.
• When the user requests tables, CSV, JSON, or ticket fields, preserve risk, evidence, priority, and boundary information.
• For machine-consumed output, confirm the schema, enums, and required fields first.

How to Use

1. Read and follow prompts/distributed-trace-analysis.md, including its input contract, execution rules, minimum coverage, and output order.
2. Add only context that changes the decision: scope, environment, version, constraints, evidence, and success criteria.
3. Audit the input, then separate confirmed facts, working assumptions, and open questions.
4. Rank by risk and evidence strength, and produce an artifact that can be executed or reviewed directly.
5. If information is missing, deliver a bounded first pass and state which conclusions remain unsupported.

Reference Files

• When calibrating domain outcomes, valid controls, or evidence gaps, read references/domain-decision-example.md for sanitized input, per-item oracles, and reproducible calculations.

• Always read prompts/distributed-trace-analysis.md; it is the complete execution specification for this skill.

• For evaluation or regression, read evals/eval.yaml and the relevant cases under evals/cases/.

• Load references/, examples/, scripts/, or output-formats.md only when those directories exist and the task needs them.

Domain Execution Essentials

1. Fix trace/span IDs, parent IDs, asynchronous links, service/deployment versions, timestamps, and sampling scope. Check nesting and clock skew; a link is not automatically synchronous parentage.
2. Within one clock domain, subtract the union of synchronous child intervals to obtain observed exclusive time; overlapping children are not additive. Missing spans limit this to observed intervals, not true exclusive work.
3. Derive critical paths from actual dependency/blocking order. Queue time requires enqueue/dequeue evidence; unexplained gaps are not automatically queues.
4. A longest span is an investigation candidate; causation needs logs/metrics/controlled faults. State separate missing-span, sampling, and clock limitations.

Core Constraints

• correlation is not causation
• account for sampling and clock skew
• inspect retries and queues, not only total latency
• Never invent system behavior, fields, data, metrics, or root causes absent from the evidence.
• Link important conclusions to evidence; mark unsupported conclusions as hypotheses with a verification method.
• Explain priority using business impact, likelihood, or detectability.

Delivery Checklist

• Covered: critical path, span latency, error propagation, retry amplification, context loss, sampling bias, cross-zone dependencies, change correlation.
• Separated facts, assumptions, gaps, and recommendations.
• Gave high-risk items a priority, evidence basis, owner or next action.
• Defined verifiable decision criteria instead of generic advice.
• Performed no unauthorized production writes or destructive actions.

Common Pitfalls

• Listing checks without preconditions, expected outcomes, or evidence.
• Marking everything high priority and avoiding tradeoffs.
• Substituting tool names or generic theory for domain reasoning.
• Refusing incomplete input, or pretending incomplete evidence supports certainty.

Best Practices

• Start with paths most likely to cause business loss, safety issues, or release blockage.
• Reduce uncertainty through the smallest verifiable experiment and record reproduction conditions.
• Make the artifact executable and independently reviewable by another engineer.