You've already forked incident-triage
Import UAPF package
121 lines
3.7 KiB
YAML
121 lines
3.7 KiB
YAML
kind: uapf.algorithm.card
|
|
id: algo.incident_triage.emit_event
|
|
version: 1.0.0
|
|
name: Case event emitter
|
|
intent: |
|
|
Appends a CaseEvent row to the case timeline. This is the canonical
|
|
way the BPMN signals "I completed a step" to the operator UI and to
|
|
the audit pipeline. Each event ends up as one row in case_events and
|
|
is also a candidate for VC signing (the VeriDocs SDK wraps a subset
|
|
of event types as Verifiable Credentials in Phase 1).
|
|
algorithm_kind: emitter
|
|
|
|
io:
|
|
inputs:
|
|
- id: case_id
|
|
type: string
|
|
cardinality: single
|
|
constraints:
|
|
pattern: "^[0-9a-fA-F-]{36}$"
|
|
- id: type
|
|
type: string
|
|
constraints:
|
|
enum:
|
|
- signal_attached
|
|
- status_changed
|
|
- triaged
|
|
- classified
|
|
- prioritized
|
|
- routed
|
|
- assigned
|
|
- ai_decision_recorded
|
|
- dmn_evaluated
|
|
- comment_added
|
|
- escalated
|
|
- resolved
|
|
- closed
|
|
documentation: Canonical event type. Used by the timeline filter pills in the operator UI.
|
|
- id: payload
|
|
type: object
|
|
documentation: |
|
|
Type-specific payload. For 'routed': {classification, priority,
|
|
ownership, group_slug}. For 'classified': {taxonomy_code,
|
|
confidence}. The schema per type is documented in the OpenITSM
|
|
case-events module.
|
|
- id: actor_label
|
|
type: string
|
|
documentation: |
|
|
Free-form actor identifier. For UAPF-driven events this is
|
|
typically 'uapf:lv.itsm.incident.triage'. For operator actions
|
|
it's 'operator:<user-slug>'.
|
|
outputs:
|
|
- id: event_id
|
|
type: string
|
|
documentation: UUID of the new CaseEvent row.
|
|
- id: recorded_at
|
|
type: string
|
|
documentation: ISO-8601 timestamp of the row insert (server clock).
|
|
|
|
implementation:
|
|
type: external
|
|
medium: mcp_tool
|
|
uri: uapf-ip://capability/event.emit@1
|
|
hash: sha256:0000000000000000000000000000000000000000000000000000000000000000
|
|
runtime:
|
|
capability: event.emit@1
|
|
note: |
|
|
Host-fulfilled UAPF-IP capability. Append-only — the host's
|
|
CaseEvent table has no UPDATE or DELETE paths exposed to UAPF
|
|
callers. The same row may later have a VC reference attached
|
|
by the VeriDocs SDK pipeline.
|
|
|
|
determinism: deterministic
|
|
side_effects: writes_state
|
|
complexity:
|
|
typical_latency_ms: 8
|
|
max_latency_ms: 2000
|
|
failure_mode: |
|
|
Throws on unknown event type or missing case_id. Caller in the
|
|
triage BPMN treats failure as soft — the case still ends in its
|
|
decided state, just without the closing 'routed' marker.
|
|
|
|
owners:
|
|
- type: team
|
|
id: openitsm-stewards
|
|
contact: stewards@openitsm.algomation.io
|
|
|
|
lifecycle:
|
|
status: draft
|
|
|
|
tests:
|
|
- name: routed-event
|
|
description: |
|
|
Standard 'routed' event at the end of triage. Payload echoes the
|
|
classification, priority, ownership, group_slug decided upstream.
|
|
inputs:
|
|
case_id: "99999999-9999-9999-9999-999999999999"
|
|
type: "routed"
|
|
payload:
|
|
classification: "security.incident"
|
|
priority: "P1"
|
|
ownership: "lvrtc"
|
|
group_slug: "soc-l2"
|
|
actor_label: "uapf:lv.itsm.incident.triage"
|
|
expected_outputs:
|
|
recorded_at: "any-iso-timestamp"
|
|
- name: ai-decision-recorded
|
|
description: |
|
|
AI decision recording — payload carries the AIDecision row id so
|
|
operators can click through to the proposal.
|
|
inputs:
|
|
case_id: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
|
|
type: "ai_decision_recorded"
|
|
payload:
|
|
capability: "ai.draft_response"
|
|
decision_id: "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
|
|
confidence: 0.7
|
|
requires_human_approval: true
|
|
actor_label: "uapf:lv.itsm.incident.triage"
|
|
expected_outputs:
|
|
recorded_at: "any-iso-timestamp"
|