Retrieval

Knowledge

Runbooks and historical incidents are retrieved as snippets with citation ids. Nothing is smuggled in from an unbounded local model. Overlap is lexical and scored; a pretty paragraph without a snippet is just prose.

How retrieval is wired

Console jobs set retrieval_enabled and pass data/knowledge/runbooks plus data/knowledge/incidents. The core chunks files, scores them against the incident context, and keeps top_k snippets (default 3) clipped to max_snippet_chars.

What a citation looks like

citation_id is a source path plus chunk id, for example data/knowledge/runbooks/checkout_latency.md#chunk-1. Reports attach these ids. Grounding then checks whether the sentence actually overlaps the snippet.

data/knowledge/runbooks

Checkout latency runbook

If checkout-service shows a sustained latency spike, inspect upstream database saturation before blaming the edge.

payments SRE

data/knowledge/incidents

Historical incident corpus

Prior incidents are retrieved as snippets and attached as citations, not as free-form memory.

incident commanders

docs/grafana_context_ingestion.md

Grafana annotations

Dashboard annotations can be folded into retrieval so the model is not the only historian.

observability

data/knowledge/runbooks

Error-budget burn

When error rate exceeds 15× baseline in two consecutive buckets, page the owning service — not every downstream waiter.

SLO guild

data/knowledge/runbooks

Memory saturation

Memory anomalies paired with GC log bursts usually precede latency. Check heap dumps after containment, not before.

platform

data/knowledge/incidents

Dependency timeouts

A 2019 checkout outage taught us that gateway 504s are often the symptom. Rank origin with the graph, then write the handoff.

Traffic disappearance

A sudden RPS drop with a quiet error ledger is often a bad deploy or a lost heartbeat, not a happy cache. Check availability first.

edge

data/knowledge/incidents

Ambiguous dual origin

When two services sit inside ambiguity_delta, keep both on the hypothesis. Do not force a single name for the exec summary.

incident commanders

Adding your own corpus

Drop Markdown under a directory inside the read allowlist, then pass that path as knowledge_source_paths on the next job. Keep snippets operational: service names, detector families, and the next check to run. Memoirs of the outage do not retrieve well. Checklists do.

Retrieval knobs

Defaults live under knowledge: in configs/default.yaml. Console jobs turn retrieval on and point at the bundled runbooks plus incidents.

top_k

Snippets kept per query. More is noisier, not smarter.

max_snippet_chars

360

Clip so compose cannot swallow a memoir.

source_paths

runbooks + incidents

Must sit inside the read allowlist.

overlap

lexical

Grounding then checks the sentence against the snippet, not the vibe.