Incident Management Platform  ·  View 12 of 34  ·  3 · Structure

Anatomy of a Page — Every Step Local to One Cell

The twelve decisions between an alert arriving and a ledger entry being written, in order, with the only external call being the carrier submit.

Editable source SVG draw.io All views
Admit Integration quota HAProxy stick table Signature check HMAC · two secrets Normalise CEL mapping per integration Fingerprint source · key · fp Decide Dedup window 24 h · site KV Grouping key CAS one open incident Resolve Coverage bucket rotation · 15 min Escalation policy versioned KV Dispatch Human dedup 60 s per channel Channel policy per severity Confirm Acknowledgement cancels step ≤ 5 s Ledger entry per attempt Anatomy of a Page — Every Step Local to One Cell Decision point Security / platform Application we own Data store Budget for alert receipt to first dispatch: p95 15 s. Nothing on this page makes a network call outside the cell except the carrier submit. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • Admission happens before parsing. A payload is counted against its integration's quota and its signature checked before a byte of it is interpreted, so a hostile or broken integration costs almost nothing to refuse.
  • Grouping is a compare-and-set on the grouping key in the paging domain. Two cells receiving the same alert at once cannot both open an incident while the sites can talk; if they cannot, both page and the reconciler labels the duplicate (ADR-04).
  • Deduplication happens twice, for different reasons: once on the alert, so a retried webhook is not a new signal, and once at the human, so a failover never produces the same SMS twice in 60 seconds.

Budget

  • Admit, normalise and decide: under 200 ms at p99. Coverage and policy lookup: one key read each. The rest of the 15-second p95 belongs to the carrier and the phone.

Omitted

  • The suppression checks inside Decide, which have their own page (view 13).