Conversation
The cases skill described the lifecycle but not the two things a triager hits first on an unfamiliar case: why it is quiet, and where it came from. Case relationships were undocumented. Links are one level and one parent, and linking a case as a child mutes it — so a child that never notifies is the design, not a delivery failure. A parent does not inline its children, so the skill shows the dataset query for them. Case provenance was undocumented because a case has no source field; it lives on indicators.genericIndicators[], which the analytics reference did not cover at all. That is also the only way to find cases Olly opened, since neither the CLI nor the API can filter by source. Adds a "what the CLI cannot do" table, because the gaps were previously only discoverable by trying: no create, no link, no mute, no list (that one was removed deliberately — discovery is a dataset query now), and labels are fixed at creation. Also documents eight dataset fields the reference omitted, including relationship, muteStatus, labelsFlat and lastReactivatedAt. Note relationship's discriminator is `type`, not the `$type` its sibling fields use. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Companion: coralogix/cx-olly#763 (Olly case-management skill and tools). |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 61bc7bfb2f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| cx dataprime "source system/labs.cases.state_updates \ | ||
| | dedupeby caseId orderby \$m.timestamp desc \ | ||
| | filter relationship != null && relationship.parentCaseId == '<parent-uuid>' \ | ||
| | choose caseId, caseNumber, title, status, priority" --from 24h |
There was a problem hiding this comment.
When an agent follows either new dataset-discovery example, Clap rejects it before the query runs: the snippets invoke cx dataprime "<query>" --from ..., but the CLI help defines raw execution as cx dataprime query ... and exposes --start/--end, not --from (src/main.rs:876-901; its example is cx dataprime query ... --start now-6h). Update both snippets to use cx dataprime query and a valid range such as --start now-24h; otherwise the documented replacement for the removed cases list command is unusable.
Useful? React with 👍 / 👎.
The relationships and Olly-provenance sections carried their own `cx dataprime` blocks, duplicating queries the analytics reference already had. Dataset queries belong in one place, so SKILL.md now keeps only what a triager needs at the CLI — what a link means, why a child is quiet, what to read first — and links to the reference for the query. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
rustls 0.23.37 accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record, against RFC 8446 section 5.1. The transcript is still authenticated, so this does not let an attacker alter a handshake; the effect is that a peer can send messages in plaintext that should have been encrypted without rustls rejecting the connection. The advisory was published 2026-09-14, after the last scheduled audit run, so master has been failing Dependency Audit since. Patched in 0.23.45; `cargo update -p rustls` alone only reaches 0.23.43, so this pins precisely and pulls rustls-webpki 0.103.15 with it. Lockfile only. cargo check and the full test suite pass unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…g-and-olly-provenance
2 participants
Context
The
cx-casesskill described the lifecycle but not the two things a triager hits first on an unfamiliar case: why it is quiet, and where it came from.Case relationships were undocumented. Links are one level and one parent, and linking a case as a child mutes it — so a child that never notifies is the design, not a delivery failure. A parent does not inline its children, so the skill now shows the dataset query for them. Direction is the easy thing to get wrong, and the dataset's discriminator is
type, not the$typeits sibling fields use.Case provenance was undocumented because a case has no source field — it lives on
indicators.genericIndicators[], which the analytics reference did not cover at all. That is also the only way to find cases Olly opened, since neither the CLI nor the API can filter by source.Adds a "what the CLI cannot do" table, because the gaps were previously discoverable only by trying: no create, no link, no mute, no list (removed deliberately — discovery is a dataset query now), and labels are fixed at creation.
Also documents eight dataset fields the reference omitted:
relationship,muteStatus,caseUrl,labelsFlat,resolutionCode,lastReactivatedAt,ollyAnalysis,schemaVersion.Linked Issues
Notes
Companion to the coralogix/cx-olly PR adding Olly's
case-managementskill; terminology, lifecycle rules and safety wording are aligned across the two so an agent moving between the CLI and Olly sees one model of how cases work.Skill version bumped to
0.2.0. The frontmatter description moves to the house trigger-phrase style (15 phrases) — the previous folded-prose form passed CI on length alone.Test plan
scripts/verify-skills.sh: cx-cases PASS (15 triggers, 201/400 lines)name/description/metadata.versioncx cases ...in the skill is an existing subcommand, and the unavailable operations are described in prose rather than as commandsverify-skills.shfailures (cx-ai-center,cx-infra,cx-service-catalog) are unrelated — they need a newercxon PATH than this machine has🤖 Generated with Claude Code