observability-hookup·execution·active

Observability Hookup

Auto-correlates load test runs with APM metrics (Datadog, New Relic, Grafana) so saturation signals — pool exhaustion, GC pauses — show up in the report.

LEOtrigger · mcp⌘ MCP · Datadog

Auto-correlates load test runs with APM metrics — Datadog, New Relic, Grafana — so saturation signals (pool exhaustion, GC pauses, lock contention) show up in the report.

When this skill fires

·A load scenario starts running, and an APM connector is configured

·LEO reaches the end of a run and needs to attach context to the report

·ARIA'sTrend Detector requests historical APM data for trend analysis

What gets correlated

For each load run, LEO captures the time window and pulls metrics from the APM:

Saturation indicators

·DB connection pool — utilization %, wait time, exhaustion events

·Thread pool / goroutine count — peak vs. baseline

·GC pauses — frequency, p95 pause duration, total time in GC

·CPU + memory — saturation thresholds (NB: low CPU + high latency is theinteresting case)

·Network — bytes/sec, retransmissions, connection resets

·Disk — IOPS, queue depth, read/write latency

Lock contention

For services with explicit lock instrumentation, LEO captures:

·Lock wait time distribution

·Top-N contended locks

·Deadlock counts

Error rate breakdown

Errors are sliced by:

·HTTP status code

·Endpoint

·Downstream dependency that returned the error

·User journey (browse vs. checkout etc.)

Why correlation, not just collection

→Raw metric dumps are useless. The value of *Observability Hookup* is time-aligning APM data with the load test phases. A p99 spike at minute 12 of a 30-minute soak is meaningful when it lines up with a GC pause; it's noise without that context.

MCP integration

This skill uses the Datadog MCP server (or equivalent) to fetch metrics by tag and time range. The connection is read-only — LEO never modifies APM configuration.

What it produces

A run-correlation report attached to the LEO output:

·Time-series chart of latency overlaid with saturation indicators

·Top-3 metrics that crossed alarm thresholds during the run

·Plain-English summary:"At 4:32 (minute 12), DB connection pool reached 95% utilization for 90 seconds, coinciding with the p99 spike to 2.4s"

The plain-English summary is what ARIA cites in the quality report. The raw data is there for engineers who want to drill in.

Configuration

→The first timeObservability Hookup runs against a new service, it asks one question: which APM tags identify this service? After that, it's silent.

MCP server endpoint

mcp://datadog.com

vendor · Datadog

Related · execution

Locator Healer

locator-healer

When a locator fails in CI, proposes a replacement based on accessibility tree diff and test history. Cuts maintenance churn by ~35%.

Scenario Synthesizer

scenario-synthesizer

Builds ramp-up, soak, spike, and chaos scenarios from a single SLO definition. Wires them to ARIA's reporting pipeline by default.

OWASP Probe Library

owasp-probe-library

Curated probes for the OWASP API + Web Top 10. Read-only and non-destructive — safe to run in shared environments and lower production tiers.

Payload Mutator

payload-mutator

Generates targeted attack payloads for injection, deserialization, SSRF, prototype pollution. Backs off on first signal of damage to stay non-destructive.

Evidence Capture

evidence-capture

For every confirmed finding, records the exact request, response, and timing. Output is replayable in seconds for engineering verification.

Adversarial Probes

nora-adversarial-probes

Red-team test suite covering the OWASP LLM Top 10 — prompt injection (direct + indirect), jailbreaks, system-prompt extraction, guardrail bypass, tool-scope escalation, insecure output handling, model DoS. Generates attack variants automatically and scores severity.