Incidents never actually clear — units_cleared almost never populates, 90-min idle sweep does the resolving instead #155
Open
opened 2026-09-20 14:33:01 -04:00 by logan
·
1 comment
No Branch/Tag Specified
Labels
Clear labels
area/ai-pipeline
area/auth
area/billing
area/correlation
area/discord
area/frontend
area/governance
area/growth
area/infra-deploy
area/legal
area/map
area/mqtt
area/node-ota
area/osint
area/recording-audio
area/sdr-radio
area/transcription
board
board:agenda
minutes:draft
minutes:final
role:ceo
role:cfo
role:cio
role:ciso
role:cmo
role:coo
role:cto
Scene/entity extraction, summarizer, AI providers, embeddings
AuthN/Z, roles, tenancy/org scoping, API keys, credentials
Plans, entitlements, AI spend accounting and caps
Incident correlation, linking, lifecycle, severity, corr_debug
Discord bot, radio bots, voice streams, bot tokens, webhooks
Web UI: Next.js app and the edge-node local dashboard
Board process, minutes, unattended runner, agent tooling
Go-to-market, outreach, cold email, discovery conversations
CI/CD, VM, registry, Firestore rules/indexes deploy, Terraform/Caddy
ToS, retention, licences/DAAs, CAN-SPAM, E&O, name suppression
Live map: pins, paths, tiles, legend, geocoding
Node-C2 MQTT, checkins, commands, node sweeper, dynsec
Node install, enrollment, OTA updater, image skew
External feeds: cameras, 511, ADS-B, AIS, outages, and their licences
Call capture, boundaries, PulseAudio, ring buffer, trimming, attribution
OP25 decode, SDR hardware/tuning, conventional, second SDR, mesh radio
STT, transcript correction, place verification, name accuracy
Board process: minutes and board-filed items
Needs board scoping at the next sitting; CEO removes the label once scoped
One exec pre-read, closed by CEO
CEO ruling; open until enacted
Filed by the CEO
Filed by the CFO
Filed by the CIO
Filed by the CISO
Filed by the CMO
Filed by the COO
Filed by the CTO
kind
behavior-bug
Wrong product behavior; the instrument reads it correctly
kind
measurement-bug
Corrupts the recording/instrument (debug data, evals, health checks), not behavior
priority
p0
Drop everything: prod broken, live exposure, or owner-ruled P0
priority
p1
Next up: blocks a gate, a customer, or core incident quality
priority
p2
Normal: real defect or planned work, schedule in turn
priority
p3
Low: minor, cosmetic, or someday
status
blocked
Waiting on an external party, spend, or another issue
status
in-progress
Branch or PR open against it
status
needs-decision
Waiting on an owner or board ruling before work
status
needs-info
Root cause or repro unknown; needs a reading first
type
bug
Something built is wrong: code, data, or a measurement
type
chore
Maintenance, refactor, tests, pinning, cleanup: no user-visible change
type
decision
A ruling to make or record: board minutes, owner calls, legal reviews
type
docs
Docs, runbooks, CLAUDE.md, skills, SOPs
type
feature
New capability or an extension of an existing one
type
security
Security, privacy, credential or tenant-isolation exposure
type
tracking
Tracker, checklist, initiative or punch-list spanning several changes
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: logan/server-26#155
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found while auditing whether incident correlation work has actually improved incident lifecycle tracking (dispatch → final unit 10-8), not just junk/duplicate suppression.
Evidence (5 correlation debug windows, 281 in-window incidents, 1721 calls scanned): only 2/281 incidents ever had a non-empty
units_cleared. Of ~183 calls with a clearance-like phrase in the transcript, only ~19 produced acleared_unitsextraction.incident_correlator.py's resolve-on-clear condition (units_cleared and not units_active → resolved) essentially never fires — 183/281 incidents in-window were instead resolved by the 90-minute idle sweep (summarizer.py), i.e. incidents time out, they don't get marked cleared by a real event.Root cause — two independent mechanisms, not one (confirmed against corr_dump_9-12/9-13/9-14.json):
reassignment=Truealready fired correctly and already suppressed the unit from re-linking to its prior incident (upload.pysetscorr_units=[]on reassignment) — but nothing ever released the unit FROM that prior incident. It just sat "active" until the idle sweep. Structural gap, not an extraction miss.vocabulary_learner.py's "known local terms" is a flat glossary, not a structured format) — departments use incompatible conventions (Yorktown:5-David, sometimes spoken as bareDavid; County:SAM-1/airport-3/parks-4, a location word + number) with zero shared pattern. Also,intelligence.py'scleared_unitsprompt rule only accepted a unit self-reporting, missing dispatch confirming a unit's status back to them (e.g. unit asks "how do you show me", dispatch replies "showing you available") — confirmed misses where a known unit ID sits directly next to a clear phrase matching the prompt's own example pattern and still got dropped.Fixed in
fb0bb15(pushed to main, deploying now):_release_reassigned_units(incident_correlator.py): onreassignment=True, scans other active incidents for unit overlap and releases the unit there via the sameunits_active/units_clearedmerge explicit-10-8 extraction uses (factored out as_apply_unit_clearance).system.unit_format_hint(owner-authored free text,GET/PUT /systems/{id}/unit-format, no auto-induction yet) fed into the extraction prompt; broadened thecleared_unitsrule to accept dispatch-confirmed availability while still requiring an identifiable unit ID (guards against bare10-8/clearnoise and Whisper-hallucination runs already caught upstream by_is_garbage_transcript).Tests: 401 pass, 0 fail (verified against a Linux venv this session set up at
~/venvs/drb-5c— note added to CLAUDE.md's testing-reality section since the documented Windows-venv path isn't the only option going forward).Not yet done: owner needs to populate
unit_format_hintfor the systems actually in use (Yorktown, County) via the new PUT route — no default value, no UI field yet (API-only for now, consistent with how ten-codes/area-context started). Auto-induction of unit-ID format (mirroringvocabulary_learner's induction loop) deliberately deferred — bigger lever, not needed yet for a 2-3-system personal-use scope.Left open pending the post-deploy live review: plan is to measure
cleared_units/units_activepopulation and the reassignment-release path against real traffic for a 2-hour window post-deploy, then reassess before closing.Related but distinct: #88 (resolved/reassignment are prompt-only invariants with no validator — a parsing-robustness gap, not this lifecycle gap).
Filed by Claude Code following up on a correlation-review audit, 2026-09-20.
Map persona panel 2026-10-05: 7 of 8 personas (TOC, NOC, RCC, GSOC, OEM, NEWS, FD) named this as a reason they would not keep the map on a wall — 'cleared/stood down' is the signal that releases a hold or crew, and false Majors at the top of the worst-first rail train the room to ignore red. It also taints history replay: nearly every
resolved_atis the idle sweep, so replayed end times run up to 90 min late. Ranked top-5 map pain point; no new issue filed.