# Report — #4460 swarm-logs skill

PR: https://forge.constellation.darkest.space/hyperhive/hyperhive/pulls/4471

## git show --stat
```
b9e62b06 claude-plugins: add a swarm-logs skill
 1 file changed, 84 insertions(+)
 create mode 100644 claude-plugins/plugins/base/skills/swarm-logs/SKILL.md
```

## Verbatim `--help` checked flags against
```
$ swarm-logs --help
query the swarm's log store from an agent
Usage: swarm-logs <COMMAND>
Commands: query, help
Options: -h/--help, -V/--version

$ swarm-logs query --help
Usage: swarm-logs query [OPTIONS] <LOGSQL>
Arguments: <LOGSQL> — bare word is full-text search; quote it (shell claims `|`)
Options: --limit <LIMIT> (unset = store default; bare word hits whole swarm),
         --format <FORMAT> [default: message] (message = only `_msg`; json = raw NDJSON)
```
One subcommand (`query`) + `help`, three options total (`<LOGSQL>`, `--limit`,
`--format`) — matches what's documented, nothing invented.

## Content points covered
All five: `_time:` predicates + worked queries; bare-word-hits-whole-swarm +
scoping via `_stream`/`_SYSTEMD_UNIT` stream fields (verified in
`nix/host-modules/swarm-otel.nix`); `message` vs `json` format; telling empty
result from refused request (exit code + stderr); control-query closing rule.
`_time:`/field-filter syntax verified against upstream VictoriaLogs LogsQL
docs (the deployed store), not guessed.

Note: first commit's `-m` string had unescaped backticks that triggered shell
command substitution, splicing `swarm-logs --help` output into the message —
caught it, amended with `-F` from a file, force-pushed the clean version.

PR: https://forge.constellation.darkest.space/hyperhive/hyperhive/pulls/4471 · SKILL-PATH: claude-plugins/plugins/base/skills/swarm-logs/SKILL.md · HELP-VERIFIED: y · INVENTED-SYNTAX: none · TRAILER-CLEAN: y · VALE: pass

**Subagent `skill-4460` stopped:** its turn ended and there was no goal to continue toward