# Folding two agent alert folders into one

Canonical page: https://convos.rob-knight.com/folding-two-agent-alert-folders-into-one-156be440
Published: 2026-10-11

- Session: 4 Oct 2026, 14:29 to 22:18 UTC
- Project: .agents
- Agent: Claude Code
- Model: claude-opus-5-5, <synthetic>
- Tags: agent-history, grafana-alerts, dashboards, otel-severity, consolidation, camden, public-repo, m7kni, grafana-alerting, grafana-dashboards, observability, backup-cleanup
- Value: 3.1 · of 4
- Time: 1h 12m · active
- Elapsed: 7h 50m · wall-clock span
- Commits: 0 · from this session
- Cost: $18.35 · model spend
- Tokens: 147k · uncached in, plus out
- Tool calls: 217 · by the agent
- Outcomes: 14 · 9 left open

## Summary

Find out why the m7kni stack has two agent alert folders and whether to consolidate them, then extend the agent-history dashboards and deploy the log severity fix.

Rob asked why m7kni had two agent alert folders, one fed by a private generator and one by the public agent-history CI. He chose to move everything into agent-history, so the agent ported the archive rules, merged overlapping collector rules and added poller-health alerts. The 17 rules shipped through CI with promtool tests, after a verifier fix for a zero pending period that Grafana drops. The old folder was exported and deleted, and the private generator was removed. Both agent-history dashboards then moved into the public repo and CI publishes them to a new folder, with new log, trace and embedding panels and log severity set. After Rob approved a camden deploy, the three services moved to the new image, and the Macs and old camden backup files were then cleaned up. Some work remains open, including the Postgres alerts and some backup files.

## What came out of it

- agent-history commit [commit] added 17 Grafana-managed alert rules generated from grafana/build_rules.py, with promtool tests and a clean CodeRabbit review; it was pushed and synced to m7kni.
- Commit [commit] fixed the CI post-push verifier, which flagged drift because Grafana drops a zero pending period; the second sync run passed.
- The old Agent Log Archive Alerts folder (12 rules) was exported to private repo's archive and then deleted from m7kni; the agent-history alerts folder holds 17 rules, all evaluating and none firing.
- The private alert generator, folder file and alert tests were removed, and the README and AGENTS.md docs now point at agent-history.
- Both agent-history dashboards are now generated in the public repo and published by CI to a new agent-history dashboards folder outside GitSync, keeping their existing IDs; the GitSync copies were retired in commit [commit].
- The CI account could not create top-level folders (HTTP 403), so the agent created the dashboards folder with the admin token; the CI account has Editor rights on it.
- A render check found all 54 new or moved panels showing data; a y-axis that auto-scaled to 10000% on zero error ratio was capped at 100%.
- Dashboard additions: a Pipeline tab, an Embedding provider tab, panels for the 31 previously unplotted metric families, and Postgres log panels. Custom variables no longer accept typed values.
- Agent-history log severity is set (ERROR, WARN, INFO); a new test failed before the change and passed after.
- The agent-history pin in the .agents lock moved to [commit] (commit [commit]), with the repo gate passing at 981 tests.
- On camden, journal-sync, the embedder and the indexer were recreated one at a time on [commit]; the database was not touched. The final report says records now arrive in Loki at level info.
- GFMBP and MBP16 were both installed to [commit], with check-profiles validated and the reader CLI working.
- On camden, 19 backup files were removed from /opt/compose, plus the agent-history compose and config backups; the nightly 38 GB catalogue dump was kept because Backrest ships it off-box.
- HRN-0230 (move the dashboards into the public repo) was closed; HRN-0227 (consolidate the alert folders) was filed and marked Done.

## Left open

- HRN-0226 is open: Postgres dead-tuple and exporter-error alerts are firing on the catalogue database, and its logs show about 3,000 FATAL 'permission denied for database agent_history_test' lines a day.
- HRN-0231 is open: the two efficiency wait counters have not changed in 30 days.
- About 10 more backup files under /opt outside /opt/compose were left alone because Rob had not approved them.
- During the camden rollout, the Loki level check timed out after 10 minutes; the level result rests on the agent's final report and was not separately confirmed in the visible transcript.
- A brief indexer restart cut off one pass, which showed as a single failed pass; the run-failed alert did not fire.
- The new alert rules do not link to dashboard panels; the agent offered to add links.
- Two docs claim the rrsync receivers are scraped for systemd state; they were left unchanged.
- Trace sampling was not changed; Rob said he would handle it with Grafana adaptive traces.
- Other sessions took HRN-0225 and HRN-0228 first, so this work was re-filed under new IDs; the agent merged the remote rather than doing the hard reset Rob had stopped.

My Grafana had two folders of alert rules for the same agent system, and I couldn't say why. One came from a private generator in my private repo. The other came from CI in the public agent-history repo. They were written a few weeks apart by agents that didn't know about each other, and they overlapped. When the indexer's collector stopped, two or three alerts fired at once, and two of them paged.

I decided to put everything under agent-history. The private archive rules were ported into the public generator, the overlapping collector alerts were merged into one, and I added alerts for the indexer's poller, which nothing had been watching. CI now ships 17 rules, and they're tested before they go out. The old folder was exported first and then deleted, and the private generator went with it. Both agent-history dashboards moved into the public repo too, with new panels for the pipeline, embeddings and Postgres logs. The logs now carry proper severity levels.

The rollout came next. I approved moving the three homelab services to the new build, and the agent restarted them one at a time without touching the database. It checked for a real successful index pass instead of assuming the processes were healthy. The restart cut off one pass, which showed as a single failure, but the failing-run alert needs fifteen minutes of errors and never fired. Both Macs now run the same version. I also cleared out a pile of old config and compose backups, and kept the nightly database dump, since it's the only copy stored off the box.

Still open: Postgres alerts are firing on the catalogue database, and its logs show a steady stream of permission errors that I haven't tracked down. A few more backup files elsewhere on the server are still there because I hadn't approved removing them. The new alert rules don't link to their dashboard panels yet, and trace sampling is unchanged for now.