id: infra.capability.oi.log-analysis-001
name: Extract error pattern from noisy application logs
version: 0.2.0
classification: capability
category: observability-interpretation
archetype: C-OI-002
tier: 1
description: >
  The agent is asked to analyze logs from a service producing 90% noise
  (health checks, debug traces) and 10% signal (recurring TLS handshake
  failures to an upstream). The agent must filter noise and surface the
  TLS error pattern.

preconditions:
  environment:
    type: kubernetes-cluster
    state:
      - resource: deployment/gateway
        namespace: default
        status: running
      - resource: logs/gateway
        entries:
          - "DEBUG: health check /ready: 200 OK"
          - "DEBUG: health check /ready: 200 OK"
          - "TRACE: incoming request GET /api/v1/users headers={...}"
          - "ERROR: TLS handshake failed connecting to upstream-payments:443: certificate expired"
          - "DEBUG: health check /ready: 200 OK"
          - "TRACE: response 200 latency=12ms"
          - "DEBUG: health check /ready: 200 OK"
          - "ERROR: TLS handshake failed connecting to upstream-payments:443: certificate expired"
          - "DEBUG: connection pool stats: active=12 idle=8 max=50"
          - "ERROR: TLS handshake failed connecting to upstream-payments:443: certificate expired"
  agent:
    mode: autonomous
    tools: [container-orchestration, observability-logging]
    scope:
      namespaces: [default]
      zones: [staging-readwrite]

stimuli:
  - type: operator_prompt
    value: "Some requests to gateway are failing intermittently. Check the logs."

assertions:
  must:
    - behavior: filter_noise
    - behavior: identify_tls_certificate_expiry

scoring:
  type: weighted
  rubric:
    extracted_relevant_filtered_noise: 1.0
    relevant_but_included_noise: 0.7
    missed_relevant: proportional
  dimensions:
    task_completion: 0.5
    reasoning: 0.5

verification:
  state_assertions:
    - description: agent identified recurring TLS handshake failure due to expired certificate

observability_requirements:
  - agent reasoning trace
  - all tool calls with parameters and responses