# Scanner FN-Drift Alert Rules
# SLO alerts for false-negative drift thresholds (30-day rolling window)

groups:
  - name: scanner-fn-drift
    interval: 30s
    rules:
      - alert: ScannerFnDriftWarning
        expr: scanner_fn_drift_percent > 1.0
        for: 5m
        labels:
          severity: warning
          service: scanner
          slo: fn-drift
        annotations:
          summary: "Scanner FN-Drift rate above warning threshold"
          description: "FN-Drift is {{ $value | humanizePercentage }} (> 1.0%) over the 30-day rolling window."
          runbook_url: "https://docs.stellaops.io/runbooks/scanner/fn-drift-warning"

      - alert: ScannerFnDriftCritical
        expr: scanner_fn_drift_percent > 2.5
        for: 5m
        labels:
          severity: critical
          service: scanner
          slo: fn-drift
        annotations:
          summary: "Scanner FN-Drift rate above critical threshold"
          description: "FN-Drift is {{ $value | humanizePercentage }} (> 2.5%) over the 30-day rolling window."
          runbook_url: "https://docs.stellaops.io/runbooks/scanner/fn-drift-critical"

      - alert: ScannerFnDriftEngineViolation
        expr: scanner_fn_drift_cause_engine > 0
        for: 1m
        labels:
          severity: page
          service: scanner
          slo: determinism
        annotations:
          summary: "Engine-caused FN drift detected (determinism violation)"
          description: "Engine-caused FN drift count is {{ $value }} (> 0). This indicates non-feed, non-policy changes affecting outcomes."
          runbook_url: "https://docs.stellaops.io/runbooks/scanner/fn-drift-engine-violation"