43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
# Scanner FN-Drift Alert Rules
|
|
# SLO alerts for false-negative drift thresholds (30-day rolling window)
|
|
|
|
groups:
|
|
- name: scanner-fn-drift
|
|
interval: 30s
|
|
rules:
|
|
- alert: ScannerFnDriftWarning
|
|
expr: scanner_fn_drift_percent > 1.0
|
|
for: 5m
|
|
labels:
|
|
severity: warning
|
|
service: scanner
|
|
slo: fn-drift
|
|
annotations:
|
|
summary: "Scanner FN-Drift rate above warning threshold"
|
|
description: "FN-Drift is {{ $value | humanizePercentage }} (> 1.0%) over the 30-day rolling window."
|
|
runbook_url: "https://docs.stellaops.io/runbooks/scanner/fn-drift-warning"
|
|
|
|
- alert: ScannerFnDriftCritical
|
|
expr: scanner_fn_drift_percent > 2.5
|
|
for: 5m
|
|
labels:
|
|
severity: critical
|
|
service: scanner
|
|
slo: fn-drift
|
|
annotations:
|
|
summary: "Scanner FN-Drift rate above critical threshold"
|
|
description: "FN-Drift is {{ $value | humanizePercentage }} (> 2.5%) over the 30-day rolling window."
|
|
runbook_url: "https://docs.stellaops.io/runbooks/scanner/fn-drift-critical"
|
|
|
|
- alert: ScannerFnDriftEngineViolation
|
|
expr: scanner_fn_drift_cause_engine > 0
|
|
for: 1m
|
|
labels:
|
|
severity: page
|
|
service: scanner
|
|
slo: determinism
|
|
annotations:
|
|
summary: "Engine-caused FN drift detected (determinism violation)"
|
|
description: "Engine-caused FN drift count is {{ $value }} (> 0). This indicates non-feed, non-policy changes affecting outcomes."
|
|
runbook_url: "https://docs.stellaops.io/runbooks/scanner/fn-drift-engine-violation"
|