Gilfoyle is a site-reliability agent skill that investigates production problems by querying an observability stack directly instead of reasoning from a description of the symptoms. It runs hypothesis-driven investigations across logs, metrics, alerts, and profiles, and installs into an agent as a skill.
Configuration is one TOML file holding per-deployment entries for Axiom, Grafana, Pyroscope, and Slack. Each deployment authenticates with an API token, a wrapper command such as cloudflared access curl, or a username and password. A setup script creates the file on first run, initializes the memory store, and can consolidate pre-existing per-tool configuration files.
Work happens through scripts grouped by backend: log queries in APL and OpenTelemetry metric queries in MPL against Axiom, dashboard queries and firing-alert listings against Grafana, flamegraphs and profile diffs against Pyroscope, message posting to Slack, and memory read, health-check, and sync commands. What it finds (patterns, useful queries, and past incidents) is written to a local memory directory and reused later.
The skill states the operating rules the agent follows: query to verify rather than guess, report what the data shows rather than what is likely, design queries to falsify a hypothesis rather than confirm it, always apply a time filter, and discover a dataset's schema with getschema in APL or --spec in MPL before querying an unfamiliar one.
Features
- Root-cause investigation: hypothesis-driven queries against the observability stack rather than symptom matching
- Triage methods: golden signals and the USE and RED methods applied systematically
- Logs and metrics: APL for log queries and MPL for OpenTelemetry metrics through one agent
- Alerts and profiles: Grafana datasource queries and firing alerts, plus Pyroscope flamegraphs and diffs
- Incident communication: post updates to a Slack channel from the command line
- Persistent memory: facts, queries, and incidents saved to disk with mem-write, checked with mem-doctor, and synced with mem-sync
- One configuration file: every backend and deployment in a single TOML file, with token, wrapper-command, or basic auth per deployment
- Config migration: an init flag consolidates existing Axiom and Grafana config files
- Self-tests: scripts that check auth integration, secret handling, and TOML parsing
