1.0 KiB
1.0 KiB
Operational incidents
M14 uses a lightweight OperationalIncident; it is not an ITSM replacement. An incident groups
alerts only when an evidenced shared subject exists.
Correlation values are:
LIKELY_ROOT: the alert directly reports the shared resource failure, such as GPU Node offline;DOWNSTREAM: a capability failure includes the same node identity;RELATED: shared timeline evidence without a directional claim;UNKNOWN: no justified causal direction.
A firing NODE_OFFLINE alert opens one node incident. Capability-unavailable alerts that carry that
node ID may join it as downstream. Other alerts stay independent rather than claiming causality.
When every grouped alert resolves, the incident resolves and appends a timeline event.
The bounded timeline stores alert state changes, relation, summary, operator acknowledgement and recovery timestamps. It never stores prompts, vectors, images, audio, document text or raw payloads. Incidents explain degradation; they authorize no remediation.