# Close the observability gap the incident exposed

The question nobody could answer during the incident, made answerable before the next one.

Category: Incident follow-through
Source: https://letsship.ai/use-cases/close-the-observability-gap
Published: 2026-08-25

## Goal

Add the instrumentation needed to answer the question the team could not answer during the incident.

## Acceptance criteria

- The question can be answered from a dashboard or a query, without reading code
- The instrumentation carries enough context to narrow by tenant or request
- The query is saved and linked from the runbook
- Cardinality is bounded so the new fields do not blow up storage

## What lands as proof

The saved query returning an answer for the incident window, which proves the gap is actually closed.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Make {question} answerable

Description: Add the instrumentation needed to answer the question the team could not answer during the incident.

Acceptance criteria:
- The question can be answered from a dashboard or a query, without reading code
- The instrumentation carries enough context to narrow by tenant or request
- The query is saved and linked from the runbook
- Cardinality is bounded so the new fields do not blow up storage

Before you create the issue, find the moment in the incident timeline where somebody said they could not tell, and replace {question} with that question.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: add the instrumentation needed to answer the question the team could not answer during the incident. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means the question nobody could answer at 3am is now answerable, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.