downtime_triage
Read-only
Identify the first alarm to inspect, likely root cause, and precursor warnings for a stopped line. Cross-checks alarm vs. RCA verdict and recommends next data.
Instructions
[READ][risk=low] One-call downtime triage: first-look alarm + RCA cause + precursors.
Answers the operator's three simultaneous questions on a stopped line — which
alarm to look at first, the likely cause, and whether anything warned us —
then cross-checks whether the first-out alarm agrees with the RCA verdict.
Composes alarm_cascade + downtime_root_cause + pdm_forecast over ONE incident;
every field traces to a sub-report echoed under 'cascade'/'rca'/
'precursor_forecasts'. Read-first and advisory: it proposes but executes
nothing. Thin evidence downgrades honestly rather than guessing.
Args:
window: {start (ISO-8601), end?, asset?, category?}. If 'end' is omitted
but state_series is given, the first running→stopped span bounds it.
alarms: Alarm/condition events — {source, timestamp, message?, priority?,
state?}. Feeds BOTH the first-out cascade and the RCA.
tags: Per-tag samples — {ref, samples:[...], warn_high?, ...} (via tag_health).
dataflow: A diagnose_dataflow result dict (localizes comms vs field).
state_series: {timestamp, state} samples to bound the window if 'end' is absent.
precursors: Signals to check for a pre-incident trend — [{signal, series:
[scalars or {value, timestamp}], warn_high?, alarm_high?, warn_low?,
alarm_low?}]; each is run through pdm_forecast and kept only when it was
degrading/imminent before the trip.
cascade_window_s: Quiet gap (s) separating alarm cascades (default 60).
lead_window_s: Causal lead window before onset (default 300s).
cause_weights: Optional per-site {cause: multiplier} RCA override.
imminent_within_s: ETA horizon that marks a precursor 'imminent' (default 24h).
include_graph: When true, the echoed 'rca' sub-report also carries a 'graph'
block — the SAME verdict re-projected as a causal graph {nodes, edges,
mermaid, meta} (signal → cause → downtime) for a frontend. Pure re-shape;
no new reasoning. Omit to keep the flat rca summary (default).
Returns dict: {window, triage:{first_look:{source, ts, cascade_size, basis},
likely_cause:{cause, verdict, confidence, confidence_band,
recommended_action}, cross_check:{status ('corroborated'|'diverging'|
'no_alarm_root'|'no_rca_primary'), detail}, precursors_missed:[{signal,
status, direction, eta_to_limit, unit, limit}], recommended_next_data},
cascade:{...}, rca:{verdict, primary_cause, top_hypotheses, graph?},
precursor_forecasts:[...], anti_hallucination}.
Example: downtime_triage(window={"start":"2026-06-28T10:00:00Z","asset":"line1"},
alarms=[{"source":"M1_DRIVE","timestamp":"2026-06-28T09:59:50Z",
"message":"motor overload trip"}],
precursors=[{"signal":"M1_temp","series":[...],"warn_high":80}]).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| alarms | No | ||
| window | Yes | ||
| dataflow | No | ||
| precursors | No | ||
| state_series | No | ||
| cause_weights | No | ||
| include_graph | No | ||
| lead_window_s | No | ||
| cascade_window_s | No | ||
| imminent_within_s | No |