If the workspace has no severity model, build one before proposing automation.
Workflow
1. Inventory the current surface
List:
event sources
current channels
existing hooks/scripts that emit alerts
duplicate paths for the same event
silent failure cases where important things are not being surfaced
Call out what ECC already owns.
2. Decide what deserves interruption
For each event family, answer:
who needs to know?
how fast do they need to know?
should this interrupt, batch, or just log?
Use these defaults:
interrupt for release, CI, security, and owner-blocking events
digest for medium-signal updates
log-only for telemetry and low-signal lifecycle markers
3. Collapse duplicates before adding channels
Look for:
the same PR event appearing in GitHub, Linear, and local logs
repeated hook notifications for the same failure
comments or status churn that should be summarized instead of forwarded raw
channels that duplicate each other without adding a better action path
Prefer:
one canonical summary
one owner
one primary channel
one fallback path
4. Design the ECC-native workflow
For each real notification need, define:
source
gate
shape
immediate alert, digest, queue, or dashboard-only
channel
action
If ECC already has the primitive, prefer:
a skill for operator triage
a hook for automatic emission/enforcement
an agent for delegated classification
an MCP/connector only when a real bridge is missing
5. Return an action-biased design
End with:
what to keep
what to suppress
what to merge
what ECC should wrap next
Output Format
CURRENT SURFACE
- sources
- channels
- duplicates
- gaps
EVENT MODEL
- critical
- high
- medium
- low
ROUTING PLAN
- source -> channel
- why
- operator owner
CONSOLIDATION
- suppress
- merge
- canonical summaries
NEXT ECC MOVE
- skill / hook / agent / MCP
- exact workflow to build next
Recommendation Rules
prefer one strong lane over many weak ones
prefer digests for medium and low-signal updates
prefer hooks when the signal should emit automatically
prefer operator skills when the work is triage, routing, and review-first decision-making
prefer
project-flow-ops
when the root cause is backlog / PR coordination rather than alerts
prefer
workspace-surface-audit
when the user first needs a source inventory
if desktop notifications are enough, do not invent an unnecessary external bridge
Good Use Cases
"We have GitHub, Linear, and local hook alerts, but no single operator flow"
"Our CI failures are noisy and people ignore them"
"I want one notification policy across Claude, OpenCode, and Codex surfaces"
"Figure out what should interrupt versus land in a digest"
"Collapse overlapping notification PR ideas into one canonical ECC lane"