F5: Threshold Alert Flow — Act Now

[ShortCipher5]

Summary

Triggered by monitoring/probing (e.g. storage at 90%). Sends a warning email with a manual "Act Now" CTA; clicking hands off to Brain to guide or execute the fix — still user-initiated.

Acceptance Criteria

• Threshold-based triggers from probing engine (storage, resource limits)
• Warning email with manual "Act Now" call to action
• Clicking CTA hands off to Brain for guided fix
• Every action requires explicit user click (no autonomous execution)
• Scheduled inspection ("patrol"): nightly sweep, AI investigates only on anomaly

Sprint Assignment

• Sprint 5: Ships as primary release

Constraints

• Launch: AI recommends but never executes autonomously
• Post-launch: narrow, verified, non-high-risk stateless ops (e.g. container restart) progressively enabled
• NEVER: any operation touching data or persistent volumes — permanently excluded

Success Metrics

• Alert-to-resolution time
• Recommendation acceptance rate