Why: This is the primary trigger — live firing alerts are what a real incident looks like.

1. Open your Grafana instance in a browser (e.g. https://yourstack.grafana.net for Grafana Cloud, or your self-hosted URL) and log in.
2. Go to Administration → Users and access → Service accounts (left sidebar).
3. Click Add service account. Give it a name (e.g. "stratos"), set Role to Viewer (read-only — never grant more than needed).
4. Open the new service account → Add service account token → click Generate token → copy it now (it's shown only once, looks like glsa_xxxxxxxxxxxx).
5. In Stratos: Configuration → 📡 Monitoring & Observability → click the Grafana card to expand it.
6. Paste your Grafana URL into Grafana URL, and the token into Service account token.
7. If Grafana Cloud (most setups): also fill CORS proxy with your deployed proxy.php URL, or run node stratos-proxy.js locally and use http://localhost:8787 — Grafana Cloud doesn't allow the browser to call it directly otherwise.
8. Click Test connection — watch the log box for ✓ health: database=ok · version=....
9. Click Extract dashboards & alerts to pull in your current firing alerts.

This only ever reads (Viewer role) — Stratos never writes to Grafana.

Why: Lets a support ticket (not just a Grafana alert) trigger an incident, auto-creates a Jira ticket when Stratos detects one, and posts runbook comments back to it.

1. Go to id.atlassian.com → sign in with the account you want Stratos to act as.
2. Click Security (left sidebar) → API tokens.
3. Click Create API token (the plain one, not "with scopes" — Jira's classic endpoints need the classic token type). Name it "stratos", set an expiry, click Create, then copy the token (shown once).
4. In Stratos: Configuration → 🎫 Ticketing & Incident Management → click the Jira card.
5. Fill: Jira URL (e.g. https://yourteam.atlassian.net), Email (the same account's login email), API Token (paste it), Project Key (the short code before ticket numbers, e.g. OPS in OPS-123).
6. Fill CORS Proxy with your deployed proxy.php or local stratos-proxy.js URL — same reason as Grafana, Atlassian blocks direct browser calls.
7. Click Test connection — the log should say ✓ Authenticated as <your name>.
8. Click Save Configuration at the bottom of the page.

Read-only by default; auto-ticket-creation is a separate checkbox you can leave off if you don't want Stratos writing to Jira.

Why: A commit or deploy shortly before an incident is one of the strongest real-world root-cause signals — Stratos checks the 90 minutes before each incident for a matching commit and boosts confidence if it finds one.

1. Go to github.com → click your profile photo (top right) → Settings.
2. Left sidebar, scroll down → Developer settings → Personal access tokens → Fine-grained tokens.
3. Click Generate new token. Name it "stratos".
4. Under Repository access, choose Only select repositories → pick the exact repo that backs the service you're monitoring (not a random/unrelated one).
5. Under Permissions → Repository permissions, find Contents → set to Read-only. (Optional: also set Actions → Read-only if you want GitHub Actions workflow-run data too.)
6. Click Generate token → copy it (starts with github_pat_).
7. In Stratos: Configuration → 🔀 Code Repository & CI/CD → click the GitHub card.
8. Fill Org / Owner (your GitHub username or org name), Repository (exact repo name, case-sensitive), Personal Access Token (paste it). No CORS proxy needed — GitHub's API allows direct browser calls.
9. Click Test connection, then Extract commits & deploys.

Gotcha: a 404 on the repo check while otherwise authenticated almost always means the token isn't scoped to see that (private) repo — go back and check step 4.

Why: A one-click "Sign in with Slack" is faster and safer to hand to a customer than asking them to mint and paste a Bot Token — this is a pilot of that pattern, on the one category not yet wired to a real tool.
The catch, up front: Slack (like almost every OAuth provider) requires a Client Secret to exchange the login code for a real token, and a Client Secret can never sit in browser JavaScript — anyone could read it from page source. So OAuth needs one small server-side file to hold that secret. A companion file, oauth-slack.php, is included for this — deploy it anywhere PHP + cURL runs (same place as proxy.php).

1. Go to api.slack.com/apps → Create New App → From scratch. Name it "Stratos", pick your workspace.
2. OAuth & Permissions (left sidebar) → Redirect URLs → add the exact URL where index.html is hosted, e.g. https://yourdomain.com/index.html.
3. Still on that page, under Scopes → Bot Token Scopes, add: channels:read, chat:write, users:read.
4. Basic Information → App Credentials → copy the Client ID and Client Secret.
5. Upload oauth-slack.php next to index.html on your hosting; open it and paste the Client Secret (and Client ID) into the two variables at the top — never into the app itself.
6. In Stratos: Configuration → 💬 Communications → Slack card → paste the Client ID (safe to put here, it's public) and the URL to your deployed oauth-slack.php into OAuth Backend URL.
7. Click Connect with Slack (OAuth) — you'll land on Slack's own authorize screen, approve, and land back here already connected. No token was ever typed or copied.

No backend deployed yet? You can still use Slack today by skipping OAuth entirely — create a Bot Token the normal way (api.slack.com/apps → OAuth & Permissions → Install to Workspace → copy Bot User OAuth Token) and paste it into the Bot Token (manual) field instead.
"Failed to fetch" on Test connection? Some networks/browsers block a direct call to slack.com from a page. Fill the CORS Proxy field with your deployed proxy.php URL (same file used for Grafana/Jira) and press Test connection again — proxy.php already allows slack.com.

Why: Feeds two separate things — "similar past incident" history on Layer 0, and matched remediation steps on Layer 8.
Where the buttons actually are: all import actions (URL/API, Jira past tickets, ServiceNow incidents, Confluence runbooks) live inside the Docs / Links / API card's panel — not on the Confluence card. The Confluence card is just where you optionally set separate Confluence credentials.
To pull past Jira tickets into history (once Jira above is connected): Configuration → 📚 Knowledge → open Docs / Links / API → click Jira past tickets.
To pull Confluence pages as runbooks:

1. First make sure Jira (above) is connected and saved — Confluence reuses it by default.
2. Open a Confluence page you want imported, confirm it's published (not a draft).
3. In Stratos: Knowledge → Docs / Links / API → click Confluence runbooks.
4. If you get HTTP 401: your Jira token isn't scoped for Confluence. Go to id.atlassian.com → Security → API tokens → Create API token with scopes → under "Select app" choose Confluence → under "Select scopes" pick the read scopes (e.g. read:content:confluence, read:page:confluence) → Create token → copy it.
5. Go back to the Confluence card itself (not Jira) → fill its own Confluence URL, Account email, API Token (the new scoped one) → this card's fields override Jira's for Confluence calls only, so your working Jira token stays untouched.
6. Retry Confluence runbooks from the Docs/Links/API card.

To pull anything else (a webpage, a Google Doc, a JSON API): paste its link into the Docs / Links / API card's KB link or API endpoint field → click Import from URL/API above. A Google Doc link auto-converts to plain text; a raw PDF link will fail (copy its text into the paste box below instead).
KB entries vs Runbooks: Jira/ServiceNow/pasted-text imports → KB entries (history matching only, Layer 0). Confluence import → Runbooks (actionable steps, Layer 8).
Notion: not built — roadmap only, the card does nothing yet.

Why: Runs a log search for the root-cause component on every incident and reinforces confidence if matching log lines turn up.

1. In Splunk: go to Settings → Tokens (or ask your Splunk admin to enable HEC/token auth if it's off).
2. Create a token for a read-only search user, copy it.
3. In Stratos: Configuration → 🔍 Log Analysis & SIEM → Splunk card → fill the REST URL (note the port — Splunk Cloud uses :8089, e.g. https://yourstack.splunkcloud.com:8089) and the token.
4. Click Test connection.

1. In Stratos: Configuration → 🎫 Ticketing → ServiceNow card → fill Instance URL, Username, Password (a read-only ITSM user is enough).
2. Click Test connection.
3. Then go to Knowledge → Docs/Links/API → click ServiceNow incidents to pull resolved incidents into KB history.

This changed: the CORS proxy, Gemini RCA Cloud Function, and the optional OpenAI/Claude comparison keys are no longer set inside this Configuration tab — there used to be input fields here, but they're gone. These four values are now centrally managed in a separate admin panel, careers.html, so every Stratos install on your Firebase project shares one configuration instead of each responder's browser needing its own copy.
Why: API keys typed into a per-install Configuration tab meant every new deployment (or every browser, before cloud sync) needed its own copy pasted in by hand, and rotating a key meant updating it everywhere. One central source fixes that.

1. Open careers.html (your admin panel) and sign in as a platform admin.
2. Switch the product switcher at the top to 🛰️ Stratos.
3. Click the 🔌 APIs tab (next to Enterprise Licenses).
4. Fill in: proxy.php URL (Shared CORS Proxy), Gemini Cloud Function URL + optional shared secret (deploy it first — see gemini-rca-fn/README.md), and optionally OpenAI/Claude API keys + models for the multi-LLM comparison panel.
5. Click 💾 Save API Configuration.

Every Stratos user picks this up automatically the next time they load or refresh the app — no redeploy, no per-browser setup. If Root Cause Analysis (Layer 8) shows an alert saying a provider "is not configured centrally yet," that's this panel — nothing is broken, it just hasn't been filled in (or saved) yet.
One-time backend step: this reads a Firestore document (platform/stratos_ai_config) — a read rule needs to exist for that path in your Firebase project's security rules, or every Stratos browser will silently fail to load it and fall back to whatever was last cached locally. See gemini-rca-fn/README.md for the exact rule.

PagerDuty/Opsgenie, Slack/Teams/WhatsApp, and the Infrastructure providers (AWS/GCP/Azure/VMware/etc.) currently have config cards but no live API wiring — their "Test connection" is a simulated pass/fail, and Slack posting is copy-to-clipboard only. Filling these in doesn't break anything, it just won't actually connect. Ask me if you want any of these made live.