Repository Docs & Knowledge Base

id: 019cb9fd-149f-7ba9-950a-af3dd53a301c name: Priority Flood Monitor kind: Anomaly cron: 0 0 * * * * analysis_window: 1h comparison_periods: [1d, 7d]

Detect when an abnormally high percentage of orders are flagged as priority, undermining the priority system and disrupting kitchen workflow.

Known Tables & Columns

curated.kitchen_orders

• guid (varchar, PK) - order identifier
• store_guid (varchar) - which store/restaurant
• is_priority (tinyint) - whether the order is flagged as priority (1=yes, 0=no)
• items_count (int) - number of items in the order
• order_type (varchar) - DINE_IN, TO_GO, DELIVERY
• pos_terminal (varchar) - POS terminal that created the order
• server_name (varchar) - server who took the order
• done (tinyint) - whether the order is complete
• is_deleted (tinyint) - soft delete flag
• create_time (int, unix timestamp) - when the order was created
• preparation_time (int, seconds, nullable) - total order preparation time

curated.kitchen_order_items

• guid (varchar, PK) - item identifier
• order_guid (varchar, FK) - parent order
• is_priority (tinyint) - whether the item is flagged as priority
• is_deleted (tinyint) - soft delete flag
• create_time (int, unix timestamp) - when the item was created

Analysis Approach

1. Query all orders created in the last {AnalysisWindow} from curated.kitchen_orders (is_deleted=0).
2. Verify that each 15-minute window contains at least 20 orders. Ignore windows with fewer data points.
3. Group into 15-minute windows and compute the priority rate: the percentage of orders where is_priority=1.
4. Compare against the historical baseline (same time windows {ComparisonPeriods}). Under normal operations, priority orders should be uncommon -- typically <10% of total orders.
5. Flag windows where the priority rate exceeds 60%, sustained over 3+ consecutive windows.
6. Investigate whether the priority flood is coming from a specific pos_terminal or server_name, which could indicate a configuration issue or user behavior problem.
7. Check the downstream impact: when everything is priority, nothing is effectively priority -- look for whether non-priority orders are being delayed.

Baseline Reference

• Normal priority rate: 5-15% of orders
• Suspicious: 40-60% of orders flagged as priority
• Anomalous: >60% of orders flagged as priority, especially >80%

Severity Guidance

• Low: Priority rate 40-60% sustained for 3+ consecutive windows
• Medium: Priority rate 60-80% sustained for 3+ windows, priority system becoming ineffective
• High: Priority rate >80% sustained -- priority system is completely compromised, all orders treated equally despite flag