20 lines
1.0 KiB
Markdown
20 lines
1.0 KiB
Markdown
# Operational incidents
|
|
|
|
M14 uses a lightweight `OperationalIncident`; it is not an ITSM replacement. An incident groups
|
|
alerts only when an evidenced shared subject exists.
|
|
|
|
Correlation values are:
|
|
|
|
- `LIKELY_ROOT`: the alert directly reports the shared resource failure, such as GPU Node offline;
|
|
- `DOWNSTREAM`: a capability failure includes the same node identity;
|
|
- `RELATED`: shared timeline evidence without a directional claim;
|
|
- `UNKNOWN`: no justified causal direction.
|
|
|
|
A firing `NODE_OFFLINE` alert opens one node incident. Capability-unavailable alerts that carry that
|
|
node ID may join it as downstream. Other alerts stay independent rather than claiming causality.
|
|
When every grouped alert resolves, the incident resolves and appends a timeline event.
|
|
|
|
The bounded timeline stores alert state changes, relation, summary, operator acknowledgement and
|
|
recovery timestamps. It never stores prompts, vectors, images, audio, document text or raw payloads.
|
|
Incidents explain degradation; they authorize no remediation.
|