task-from-datadoglisted

# Task from Datadog ## When to use this skill The user typed `/tcgflow-task-from-datadog` or said: *"create a task from the latest incident"*, *"investigate the spike"*, *"process the Datadog alert about X"*. Triggered manually, usually after a paging alert or post-incident. ## Procedure 1. **Identify the source artifact.** Datadog produces several signal types — handle each: - **Incident** (declared via Datadog Incident Management) — has an ID, status, severity, timeline. - **Monitor alert** (triggered threshold) — has monitor name, current state, evaluation window. - **Anomalous trace** (APM) — span/trace ID, latency, error rate. - **Log spike / error surge** — log query, time range, sample messages. Use the Datadog MCP if configured; fall back to a paste from the user. 2. **Dedup.** Search `tasks/active/` and `tasks/completed/` for the incident ID, monitor name, or related trace IDs. If a prior task exists and is still active, **append** a subtask to it rather than creating a new task. 3. **Generate ONE task per signal:** - **Task ID:** prefer Datadog's incident ID if present (`INC-{number}` or `INCIDENT-{number}`). Otherwise: `OPS-{YYYY-MM-DD}-{monitor-or-service-slug}`. - **Status:** `PLANNED`. - **Risk:** at least HIGH; **CRITICAL** if the alert is on a production-only system or `governance.md` flags the affected service as critical. 4. **Subtask shape.** Four standard subtasks (adjust based on signal type): - **Investigate** — *Accept