executor: Skill for Claude Code

Production telemetry access

All three stores are queryable through the Executor MCP's connected integrations — no dashboards or credentials needed. Verify the connection exists with connections.list if a call fails.

Axiom traces (axiom_mcp)

Tool: axiom_mcp.user.axiomMcpOAuth.querydataset — the argument is apl (NOT query). Dataset: ['executor-cloud'] (worker spans; browser spans join the same traces via traceparent).

Field layout (the part you'd otherwise rediscover by failed queries):

• Custom span attributes live under the JSON map ['attributes.custom'], NOT as top-level attributes.* columns. Read with ['attributes.custom']['mcp.tool.name']. A nonexistent top-level field is a hard query error ("invalid field"), not an empty result.
• Span status: ['status.code'] ("OK"/"ERROR"), ['status.message'].
• Exceptions: the events column carries exception.type / exception.stacktrace JSON.
• OTel basics are top-level: name, trace_id, span_id, parent_span_id, duration, _time.

Span names worth querying (and their custom attrs):

• mcp.execute / mcp.execute.resume — mcp.execute.mode (pausable/inline), mcp.execute.code_length, and mcp.execute.outcome (ok/fail/paused) with, on failures, mcp.execute.error_kind (type_error | reference_error | syntax_error | range_error | tool_error | timeout | resource_limit | serialization_error | thrown | unknown). Sandbox script failures ride the MCP success channel, so status.code stays OK — filter on these attributes, not span status. Spans from before the attributes shipped carry neither; absence is not success. Also mcp.execute.result_chars (compact-JSON size of the returned value, pre-truncation; -1 = unmeasurable), mcp.execute.log_chars, mcp.execute.emitted — the dump-vs-narrow signal (the model preview truncates at 30k chars, so result_chars > 30000 means the model tried to pull a truncated blob into context).
• executor.tool.execute — mcp.tool.name (full address), and since PR #992: executor.tool.outcome (ok/fail), executor.tool.error_code, executor.tool.error_status, executor.tenant, executor.subject.
• mcp.tool.dispatch — mcp.tool.name (sandbox path), mcp.tool.integration, same outcome attrs.
• plugin.openapi.invoke — plugin.openapi.method / path_template / base_url, and since PR #992 http.status_code.
• mcp.request (outer) — mcp.auth.organization_id, mcp.auth.account_id, mcp.tool.name, CF edge fields (cf.country…), MCP client fingerprint (mcp.client.name…), and on managed-cloud execute/execute-action calls mcp.execute.code (the script itself, capped at 10k chars — cloud-only content capture; local/self-host telemetry never records content).
• auth.authorize_organization — every membership authorization. Reads the local membership mirror unconditionally; there is no per-request readiness check and no WorkOS fallback, so this span carries no readiness attribute. The mirror's write spans are workos_mirror.<op>; the reconciler run is workos_events.sync. workos_sync.drained_at in the prod DB is the reconciler heartbeat, and a stalled reconciler now raises its own error from the cron (see below) rather than showing up as a fallback here.