# Unknowns queue operations

Purpose
- Manage unknown components with deterministic triage and SLA tracking.

Queue model
- Bands: HOT, WARM, COLD based on score and SLA.
- Reasons include reachability gaps, provenance gaps, VEX conflicts, and ingestion gaps.

Core workflows
- List and triage unknowns by band and reason.
- Escalate or resolve with documented justification.
- Suppress with expiry and audit trail when approved.

Budgets and SLAs
- Per-environment budgets cap unknowns by reason.
- SLA timers trigger alerts when breached.

Monitoring
- unknowns_total, unknowns_hot_count, unknowns_sla_breached
- unknowns_escalation_failures, unknowns_avg_age_hours
- KEV-specific unknown counts and age

Alerting cues
- HOT band spikes or SLA breaches.
- KEV unknowns older than 24 hours.
- Rising queue growth rate.

Related references
- signals/unknowns.md
- signals/unknowns-ranking.md
- docs/operations/unknowns-queue-runbook.md