groups:
  - name: triage-ttfs
    rules:
      - alert: TriageTtfsFirstEvidenceP95High
        expr: histogram_quantile(0.95, sum(rate(stellaops_ttfs_first_evidence_seconds_bucket[5m])) by (le)) > 1.5
        for: 10m
        labels:
          severity: critical
          service: triage
        annotations:
          summary: "TTFS first evidence p95 high"
          description: "TTFS first-evidence p95 exceeds 1.5s for 10m (triage experience degraded)."

      - alert: TriageTtfsSkeletonP95High
        expr: histogram_quantile(0.95, sum(rate(stellaops_ttfs_skeleton_seconds_bucket[5m])) by (le)) > 0.2
        for: 10m
        labels:
          severity: warning
          service: triage
        annotations:
          summary: "TTFS skeleton p95 high"
          description: "TTFS skeleton p95 exceeds 200ms for 10m."

      - alert: TriageTtfsFullEvidenceP95High
        expr: histogram_quantile(0.95, sum(rate(stellaops_ttfs_full_evidence_seconds_bucket[5m])) by (le)) > 1.5
        for: 10m
        labels:
          severity: warning
          service: triage
        annotations:
          summary: "TTFS full evidence p95 high"
          description: "TTFS full-evidence p95 exceeds 1.5s for 10m."

      - alert: TriageClicksToClosureMedianHigh
        expr: histogram_quantile(0.50, sum(rate(stellaops_clicks_to_closure_bucket[5m])) by (le)) > 6
        for: 15m
        labels:
          severity: warning
          service: triage
        annotations:
          summary: "Clicks-to-closure median high"
          description: "Median clicks-to-closure exceeds 6 for 15m."

      - alert: TriageEvidenceCompletenessAvgLow
        expr: (sum(rate(stellaops_evidence_completeness_score_sum[15m])) / clamp_min(sum(rate(stellaops_evidence_completeness_score_count[15m])), 1)) < 3.6
        for: 30m
        labels:
          severity: warning
          service: triage
        annotations:
          summary: "Evidence completeness below target"
          description: "Average evidence completeness score below 3.6 (90%) for 30m."

      - alert: TriageBudgetViolationRateHigh
        expr: sum(rate(stellaops_performance_budget_violations_total[5m])) by (phase) > 0.05
        for: 10m
        labels:
          severity: warning
          service: triage
        annotations:
          summary: "Performance budget violations elevated"
          description: "Performance budget violation rate exceeds 0.05/s for 10m."