# Incident Escalation Policy
# Controls deterministic escalation and auto-resolve candidate logic.

defaults:
  window_minutes: 60

escalation:
  # Escalate when the same signature storms
  occurrences_thresholds:
    P2_to_P1: 10      # occurrences_60m to escalate P2 → P1
    P1_to_P0: 25      # occurrences_60m to escalate P1 → P0

  triage_thresholds_24h:
    P2_to_P1: 3       # triage_count_24h to escalate P2 → P1
    P1_to_P0: 6       # triage_count_24h to escalate P1 → P0

  severity_cap: "P0"  # never escalate above this

  create_followup_on_escalate: true
  followup:
    priority: "P1"
    due_hours: 24
    owner: "oncall"
    message_template: "Escalated due to alert storm: occurrences={occurrences_60m}, triages_24h={triage_count_24h}"

auto_resolve:
  # Candidates only in MVP — do not auto-close P0/P1
  no_alerts_minutes_for_candidate: 60
  close_allowed_severities: ["P2", "P3"]
  auto_close: false             # set true carefully in staging only
  candidate_event_type: "note"
  candidate_message: "Auto-resolve candidate: no alerts observed in {no_alerts_minutes} minutes for this signature"

alert_loop_slo:
  claim_to_ack_p95_seconds: 60   # p95 latency from claim → ack
  failed_rate_pct: 5             # max % of failed/(acked+failed) in window
  processing_stuck_minutes: 15   # alerts in processing beyond this → stuck