run_1a6af0810992ae5f

input

{
  "request": "Triage Jira ticket MZCLD-3658: Fix \"Certificate Expiration\" blackbox alert routing (remove hard-coded SRE Green contact point)",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/MZCLD-3658"
  ],
  "sourceContext": {
    "issue": "MZCLD-3658"
  }
}

summary

MZCLD-3658 is a Backlog ticket (0 comments) documenting a known anti-pattern in the Yardstick "Certificate Expiration" Grafana alert rule (folder "SRE - Green", uid ce6ja04ce4kqoa): it uses a hard-coded `notification_settings.receiver = "SRE Green: Low"` override that bypasses the centralized notification policy, mirroring the legacy pattern being cleaned up under MZCLD-3140. The ticket proposes removing the override, relabeling with `team=mozcloud` + a decided `severity`, and adding a `runbook_url` pointing to Confluence page 2728264348 ("Handling Certificate Expirations"), then letting policy-based routing take over. I could not fetch MZCLD-3140 or the Confluence runbook page in this session (blocked by run policy), so I've relied solely on the MZCLD-3658 description for context. The ticket explicitly notes the actual Grafana/Yardstick config edit must be applied by André since the ticket author's token is read-only — this Jira ticket is meant to capture the target state/spec rather than be self-executing.

findings

• Root problem is confirmed and well-documented: the alert rule's hard-coded contact-point override (`SRE Green: Low`) bypasses the notification policy, matching the anti-pattern MZCLD-3140 is remediating elsewhere.
• The rule is also missing standard labels (`severity`, `runbook_url`) needed for the notification-policy-based routing to work correctly once the override is removed.
• An open decision blocks implementation: whether a cert expiring in <7 days should route as low severity (Slack #infra-mozcloud-eng) or high severity (PagerDuty page). The ticket author flags this as unresolved and 'arguably high'.
• The reporter cannot make the Yardstick/Grafana change themselves (read-only token); implementation depends on André. This ticket therefore functions as a spec, and needs an owner/assignee with write access plus explicit sign-off on the severity decision before work can proceed.
• Supporting context (MZCLD-3140 parent cleanup ticket and the Confluence runbook page 2728264348) could not be retrieved in this session due to access policy restrictions, so cross-ticket consistency (e.g., matching label conventions used in MZCLD-3140) could not be independently verified.
• Ticket has no comments and is sitting in Backlog, suggesting it hasn't been triaged/assigned or scheduled yet despite having a fully-specified proposed fix.

proposed actions

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3658"
    },
    "result": {
      "key": "MZCLD-3658",
      "summary": "Fix \"Certificate Expiration\" blackbox alert routing (remove hard-coded SRE Green contact point)",
      "status": "Backlog",
      "description_text": "Surfaced during the MZCLD-3236 certificate-runbook review. Current state  \u2014 Yardstick Grafana alert rule  Certificate Expiration  (uid  ce6ja04ce4kqoa , folder \"SRE - Green\", dashboard  de6f508vhtfcwa  panel 8): Fires at 7 days to expiry:  probe_ssl_earliest_cert_expiry - time() <= 604800 Hard-coded contact-point override:  notification_settings.receiver = \"SRE Green: Low\"  \u2192  bypasses the notification policy Label: only  team=sre-green ;  no  severity ,  no  runbook_url Problem  \u2014 this is the same legacy anti-pattern MZCLD-3140 is cleaning up (hard-coded SRE Green contact point instead of policy routing). Secondary: a cert within 7 days of expiry currently routes only to a \"Low\" receiver, which may be under-alerting. Proposed fix (MZCLD-3140 standard): Remove the  SRE Green: Low  contact-point override ( notification_settings ) Add labels  team=mozcloud  +  severity  (decide: low \u2192 Slack  #infra-mozcloud-eng , or high \u2192 PagerDuty page \u2014 cert <7d to expiry is arguably high) Add  runbook_url  \u2192 \"Runbook: Handling Certificate Expirations\" (Confluence page 2728264348) Let the notification policy route it Note: Yardstick changes are applied by Andr\u00e9 (my token is read-only) \u2014 this ticket documents the target state.",
      "comment_count": 0,
      "comments": []
    }
  },
  {
    "capability": "confluence.page.read",
    "args": {
      "id": "2728264348"
    },
    "result": {
      "error": "read blocked by policy: resource not in run subject",
      "args": {
        "id": "2728264348"
      }
    },
    "blocked": true
  },
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3140"
    },
    "result": {
      "error": "read blocked by policy: resource not in run subject",
      "args": {
        "key": "MZCLD-3140"
      }
    },
    "blocked": true
  }
]

log