From hydra-audit-trail
Routes HIGH and CRITICAL audit-trail events to an operator-configured webhook (PagerDuty, Opsgenie, Slack, generic). Reads new rows from state/audit.jsonl since the last cursor and POSTs a generic event payload. Use when the developer asks about on-call paging, alert routing, webhook setup, audit-event escalation, or wants to verify F-011 closure. Auto-triggers on: "page on-call", "wire pager", "paging config", "alert routing", "F-011", "send HIGH events to", "configure webhook". Do not use for crafting the audit log itself (see audit-awareness) or for verifying chain integrity (see audit-verify).
How this skill is triggered — by the user, by Claude, or both
Slash command
/hydra-audit-trail:pagingThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
<purpose>
cd ${CLAUDE_PLUGIN_ROOT}
cp state/paging-config.example.json state/paging-config.json
# Edit state/paging-config.json:
# - enabled: true
# - webhook_url: <your endpoint>
# - min_severity: HIGH (or CRITICAL for stricter routing)
paging-config.json is gitignored — keep your webhook URL local.
python3 ${CLAUDE_PLUGIN_ROOT}/scripts/pager.py --dry-run
Expected output: JSON summary with dry_run: true. No webhook POST.
The cursor advances even on dry-run — re-run will report scanned: 0
unless new audit rows have landed.
python3 ${CLAUDE_PLUGIN_ROOT}/scripts/pager.py
Output JSON includes delivered, undelivered, rate_limited. If
undelivered > 0, the rows are queued in state/paging-undelivered.jsonl
with a retry counter.
python3 ${CLAUDE_PLUGIN_ROOT}/scripts/pager.py --retry
Successfully retried events are dropped from the queue. Events past
max_retries are dropped and logged as exhausted in state/paging-runs.log.
Wire pager.py into a cron/systemd timer. Suggested cadence:
| Time window | Cadence |
|---|---|
| Business hours | every 30s |
| Off-hours | every 5m |
| Retry sweep | every 15m, post --retry |
<config_reference>
| Field | Default | Meaning |
|---|---|---|
enabled | false | Master switch. False = classify only, never POST. |
webhook_url | "" | JSON-POST endpoint. |
min_severity | "HIGH" | Floor: DEBUG < INFO < LOW < MEDIUM < HIGH < CRITICAL. |
rate_limit_per_min | 5 | Token bucket. Suppressed pages do NOT enter the retry queue. |
timeout_seconds | 5 | Per-POST timeout. |
max_retries | 3 | Drop undelivered after this many retries. |
</config_reference>
<failure_modes>
</failure_modes>
Advisory only. Paging is observability, not a gate. Even when the webhook is unreachable, pager.py exits 0 and writes to `state/paging-undelivered.jsonl`. F-011 closure: HIGH+ events are routed to operator-configured paging. Operator wires the actual endpoint; this skill ships the routing.npx claudepluginhub enchanter-ai/hydra --plugin audit-trailProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.