Alerts and Incidents
Why something interrupts you, what a person did to it, and how a quiet answer proves itself.
Alerts and Incidents Documentation
Interruption here is a function of agency, not of severity. Something asks for you when a decision only you can make still changes the outcome. Where the platform already acted at the network layer and the action held, you get a receipt instead of a page.
Lane, state, interrupt
Lane is the plane's own reading of a condition: whether it wants a decision now, wants review, or is not asking at all.
State is what a person did to it: open, acknowledged, snoozed, resolved. Acknowledging says a human has this, never that it is handled, so an acknowledged detection stays exactly as open as the plane left it. Snoozing hides a row until you reopen it.
Interrupt is whether it reaches you right now: a page, a digest, or silence. Keeping it apart from the lane is the point. Something the platform did may lower how loudly a condition reaches you; something merely believed may only raise it.
The state is the same mark every surface reads, so acknowledging in the console silences it in the CLI, and the other way round.
The quiet answer proves itself
A pipeline that broke and an estate with nothing happening are different sentences, never the same blank space. A quiet answer tells you how many hosts reported, what was severed, which rules are holding quiet, and which streams did not answer at all. The register of rules holding quiet is readable in its own right, so a mute is never invisible.
Repeated hits on the same technique across many hosts fold into one wave carrying the roster of machines it touched, rather than arriving as one row per machine.
From the terminal
whisper alerts list is the queue worst-first, show is one condition in full, and watch tails it live and keeps proving it is alive while it is quiet. ack, assign, note, snooze, reopen and resolve are the verbs that move state, and each one lands where the console reads it.
To gate a script, the exit code is the answer:
whisper alerts check
| Exit code | Meaning |
|---|---|
0 | nothing is asking for a decision |
3 | something is asking |
1 | the check could not tell |
The third is a real answer, not a failure to have one: a check that cannot reach the plane must not report quiet.
Incidents
An incident is the case a set of findings belongs to, and the console carries a list and a per-incident detail you can export as a report. Findings arrive held: what turns one into an action is the response ladder, and the procedure is contain an endpoint. A firm running incidents across many customers works from the queue instead.