Flow: Scheduled Runtime Execution (Detection + Alerting)

This flow is non-interactive. A scheduler triggers execution of enabled monitors. The system runs the monitor runbook, performs evidence gathering, verifies conclusions, and emits alerts via the external notification tool.

Primary objectives:

• Execute MonitorSpec on a schedule (2h/day/week).
• Detect ad-hoc issues using LLM-driven reasoning over tool-returned evidence.
• Reduce noise via verification and dedupe.
• Emit a strict alert payload: Name, Summary, Content(Markdown), Severity.

Sub-diagram

flowchart TD
  SCH["Scheduler"] --> ORCH["Run Orchestrator"]
  ORCH -->|"Load spec"| SPEC["MonitorSpec Store (versioned)"]

  ORCH --> DET["Runtime Detector (LLM)"]
  DET <--> SEM["KB/Semantic Agent"]
  SEM --> CM["Capabilities Manifest"]
  SEM --> KPI["KPI Catalog"]
  SEM --> DOC["Doc Index (RAG)"]

  DET <--> DA["Data Access Agent (MCP/tools)"]
  DA --> W["Warehouse DB(s)"]

  DET --> CRIT["Critic/Verifier (LLM)"]
  CRIT -->|"Needs more evidence"| DET
  CRIT -->|"Alert approved"| EMIT["Alert Emitter"]

  EMIT --> TOOL["Alert Tool Call<br/>Name • Summary • Content(MD) • Severity"]
  TOOL --> NOTIF["External notification system"]

  ORCH --> MEM["Run History + Dedupe Memory"]
  EMIT --> MEM

  classDef store fill:#f6f8fa,stroke:#9aa4b2,color:#111;
  class SPEC,CM,KPI,DOC,W,MEM store;

Runtime execution loop (high-level)

1. Preflight: verify data freshness and prerequisites; if missing, record diagnostics (do not alert as “anomaly”).
2. Broad scan: compute the monitor’s standard feature panels (trend deltas, distributions, cohorts).
3. Drilldowns: detector requests targeted slices to explain suspicious changes (hour-of-week, station, channel, item/category mix, etc.).
4. Verification: critic checks evidence quality (baseline validity, sample sizes, missingness/outages, mix shifts).
5. Emit: if approved, alert emitter sends tool payload and records run history/dedupe info.