altinity-expert-clickhouse-audit

Startup Procedure

Connectivity selection and setup is handled by the caller (upper prompt/orchestrator). Run a minimal preflight (e.g. select 1) and fail fast if connectivity is not OK.

Module Index

Complete module registry. This is the single source of truth for audit coverage.

Load modules with skill invocation: /altinity-expert-clickhouse-{name}

Global Query Rules

Apply to ALL modules.

SQL Style

• Lowercase keywords: select, from, where, order by
• Explicit columns only, never select *
• Default limit 100 unless user specifies otherwise
• No comments in executed SQL

Time Bounds (Required for *_log tables)

-- Default: last 24 hours
where event_date = today()

-- Or explicit time window
where event_time > now() - interval 1 hour

-- For longer analysis
where event_date >= today() - 7

Result Size Management

• If query returns > 50 rows, summarize before presenting
• For large result sets, aggregate in SQL rather than loading raw data
• Use formatReadableSize(), formatReadableQuantity() for readability

Schema Discovery

Before querying unfamiliar tables:

desc system.{table_name}

Response Guidelines

• Direct, professional, concise
• State uncertainty explicitly: “Based on available data…” or “Cannot determine without…”
• Provide specific metrics and time ranges
• When suggesting fixes, reference documentation or KB articles
• If analysis incomplete, state what additional data would help

Audit Severity Levels

All modules use consistent severity classification:

Query Output Patterns

Modules provide three types of queries:

1. Audit Queries – Return severity-rated findings:

   • Columns: object, severity, details
   • Run these first for quick assessment

2. Diagnostic Queries – Raw data inspection:

   • Current state without severity rating
   • Use for investigation

3. Ad-Hoc Guidelines – Rules for safe exploration:

   • Required safeguards (LIMIT, time bounds)
   • Useful patterns