v0.2

docs/03-notification-timing-sla.md

@@ -0,0 +1,46 @@
+# 03 — Notification Timing & SLA Model
+
+The 7 May 2026 incident's defining failure was a **~40-minute** gap between a
+visible air threat and the public cell-broadcast reaching Rezekne. This package
+treats notification speed as a **first-class, modelled quantity** rather than an
+implicit expectation.
+
+## The SLA chain
+
+1. `Decision_NotificationUrgency` takes `threatLevel` and the estimated minutes
+   until the object could reach people, and outputs:
+   - `notificationTier` — `immediate | priority | standard | none`
+   - `broadcastSlaSeconds` — the **maximum** time allowed from authorisation to
+     confirmed dispatch.
+2. `Task_DispatchBroadcast` (VUGD) carries a **non-interrupting boundary timer**
+   armed at `broadcastSlaSeconds`.
+3. If dispatch is not confirmed before the timer fires, `Task_EscalateSla`
+   runs **in parallel** — it does not cancel the broadcast, it escalates the
+   delay to the Crisis Management Centre so a human intervenes.
+
+## Proposed SLA defaults
+
+| Threat level | Lead time | Tier | `broadcastSlaSeconds` | Rationale |
+|--------------|-----------|------|----------------------:|-----------|
+| critical | any | immediate | 120 | Object inside airspace, closing on people. |
+| high | ≤ 15 min | immediate | 180 | Little lead time; alert must precede impact. |
+| high | > 15 min | priority | 300 | Lead time exists; brief verification window. |
+| elevated | any | priority | 600 | Threat present, not yet tracking toward people. |
+| low | any | standard | 1800 | Advisory only. |
+| none | – | none | 0 | No public broadcast. |
+
+Against these defaults, the Rezekne broadcast (~2400 s) breached even the most
+lenient non-zero SLA **by an order of magnitude**. Under this model the boundary
+timer would have fired at 120–180 s and escalated to KVC ~38 minutes earlier.
+
+## Guardrail
+
+`broadcastSlaSeconds` is a **hard floor for escalation, not a target for
+dispatch** (guardrail GR-3). Dispatch should normally be far faster; the SLA is
+the line past which the absence of a broadcast becomes its own incident.
+
+## Open for validation
+
+The table values are **modelling proposals**. They need calibration against
+real NBS classification timelines and VUGD cell-broadcast dispatch latencies
+before the package can leave `draft`.