# Flow: Scheduled Runtime Execution (Detection + Alerting)

This flow is non-interactive. A scheduler triggers execution of enabled monitors. The system runs the monitor runbook, performs evidence gathering, verifies conclusions, and emits alerts via the external notification tool.

Primary objectives:

- Execute `MonitorSpec` on a schedule (2h/day/week).
- Detect **ad-hoc** issues using LLM-driven reasoning over tool-returned evidence.
- Reduce noise via verification and dedupe.
- Emit a strict alert payload: `Name`, `Summary`, `Content(Markdown)`, `Severity`.

## Sub-diagram

```mermaid
flowchart TD
  SCH["Scheduler"] --> ORCH["Run Orchestrator"]
  ORCH -->|"Load spec"| SPEC["MonitorSpec Store (versioned)"]

  ORCH --> DET["Runtime Detector (LLM)"]
  DET <--> SEM["KB/Semantic Agent"]
  SEM --> CM["Capabilities Manifest"]
  SEM --> KPI["KPI Catalog"]
  SEM --> DOC["Doc Index (RAG)"]

  DET <--> DA["Data Access Agent (MCP/tools)"]
  DA --> W["Warehouse DB(s)"]

  DET --> CRIT["Critic/Verifier (LLM)"]
  CRIT -->|"Needs more evidence"| DET
  CRIT -->|"Alert approved"| EMIT["Alert Emitter"]

  EMIT --> TOOL["Alert Tool Call<br/>Name • Summary • Content(MD) • Severity"]
  TOOL --> NOTIF["External notification system"]

  ORCH --> MEM["Run History + Dedupe Memory"]
  EMIT --> MEM

  classDef store fill:#f6f8fa,stroke:#9aa4b2,color:#111;
  class SPEC,CM,KPI,DOC,W,MEM store;
```

## Runtime execution loop (high-level)

1. **Preflight**: verify data freshness and prerequisites; if missing, record diagnostics (do not alert as “anomaly”).
2. **Broad scan**: compute the monitor’s standard feature panels (trend deltas, distributions, cohorts).
3. **Drilldowns**: detector requests targeted slices to explain suspicious changes (hour-of-week, station, channel, item/category mix, etc.).
4. **Verification**: critic checks evidence quality (baseline validity, sample sizes, missingness/outages, mix shifts).
5. **Emit**: if approved, alert emitter sends tool payload and records run history/dedupe info.