Alarm Escalation - Raising and Routing Instrumentation Mesh Alarms
Every stream on the Instrumentation Mesh is scored against a threshold band by GOVERNOR. When a band is breached, GOVERNOR raises an alarm, classifies it into one of four severity tiers, deduplicates it against open incidents, and escalates it to the responders that tier demands. This page documents that pipeline: the severity matrix, the detection-triage-response flow, the per-channel thresholds, and the Black-tier auto-page that pulls in the Director and the response drill.
How GOVERNOR Raises an Alarm
GOVERNOR watches Instrumentation Mesh telemetry continuously, comparing each metric to its calibrated band. A breach opens a candidate alarm; GOVERNOR enriches it with neighbouring streams, assigns a severity, and either folds it into an existing incident or escalates it. Lower tiers stay on the analytics queue; higher tiers reach people, and the top tier reaches the response & drill ladder automatically. The matrix below defines what each tier means and who it reaches.
Alarm-Severity Matrix
Four severity bands, escalating from Green through Amber and Red to Black. Severity is set by the worst breach contributing to the alarm; an alarm only escalates downward (toward Black), never silently upward.
| Severity | Example trigger | Notified | Response target | Escalation |
|---|---|---|---|---|
| GREEN | All metrics within band; mesh coverage nominal. | Logged only — visible on the Live Command Wall. | — | None; held as baseline. |
| AMBER | Single relay offline; brief attention-load dip; minor session-dwell drift. | Instrumentation Mesh engineering queue (GOVERNOR digest). | Next shift | Auto-promotes to Red if the breach persists past one shift. |
| RED | Cohort focus out of band; recommender-chatter signature; sustained dwell spike; coverage gap. | On-call surface analyst + duty analyst at the duty desk. | ≤ 30 min | Opens a response drill if unacknowledged in 30 min. |
| BLACK | PL-4 containment breach; Restricted-Technique Vault power loss; dark-pattern spike; multi-node partition. | Director, duty officer, and the full drill ladder. | Immediate | Auto-pages the Director and triggers the drill — see below. |
Detection · Triage · Response
Every alarm moves through the same three stages before it reaches a human.
GOVERNOR on Instrumentation Mesh
GOVERNOR scores each Instrumentation Mesh stream against its band in real time. A sustained or sharp breach opens a candidate alarm, stamped with the source channel, node, and the telemetry that tripped it. Raw signal keeps flowing to the Live Command Wall even if scoring is degraded.
Auto-classify & dedupe
GOVERNOR assigns a severity tier from the matrix, then deduplicates: a new alarm that matches an open incident's channel and signature is folded in rather than re-raised, so a single event never floods the desk. Correlated breaches across nodes are merged into one ranked incident.
Route to duty desk / drill
The classified incident is routed to the responders its tier demands — engineering queue, duty desk, or the drill ladder. Acknowledgements, holds, and clears are tracked back on the status board until resolved.
Example Channels & Alarm Thresholds
A sample of the Instrumentation Mesh channels GOVERNOR scores, with the band that raises each tier. Every channel maps to a named figure in the Metrics catalogue; thresholds below are the 2091 baseline calibration.
| Channel | Amber | Red | Black | Linked metric |
|---|---|---|---|---|
| Population focus | ±0.5 drift from 35 min mean dwell | Outside 33–36 min band for > 10 min | Outside 30–38 min — cohort capture imminent | Population Focus |
| Dark-pattern residue | 1–4 signatures in entry funnels | 4–10 confirmed in flows/consent walls | > 10 — acute manipulation event | Dark-Pattern Telemetry |
| Mesh coverage | Channel coverage 95–98% | Coverage 85–95% or cell gap | < 85% or multi-node fabric partition | Undertow Coverage |
| Counter-readiness | Pre-surge hum + dwell plateau | Recommender chatter + capped relay cells | Active outrage cascade detected | Acoustic Signature |
| Containment integrity | PL seal pressure drift | PL-3 seal degraded; airlock fault | PL-4 breach or Restricted-Technique Vault power loss | Containment Integrity |