Alert noise filtering
Your observability stack produces thousands of log anomalies a day and the on-call has learned to ignore most of them. Design an agent that sits between raw anomaly detection and the pager, deciding what's signal and what's noise. What context does it use, what can it suppress on its own, and what must always page? Walk me through the evaluation — how do you measure whether it's making alert fatigue better rather than hiding real incidents — and sell the investment.
route_anomalies(anomaly_lines: list[str], always_page_signatures: list[str], page_score_threshold: int, ticket_score_threshold: int) → list[str][["checkout-latency|0|0|91","log-noise|0|0|12","db-timeouts|1|0|40"],["auth-failures"],80,30]out["page-score","suppress-low","page-mandatory"][["cache-miss-spike|0|0|55","cache-miss-spike|0|0|55","auth-failures|0|0|5","auth-failures|0|0|5"],["auth-failures"],80,30]out["ticket","suppress-duplicate","page-mandatory","page-mandatory"][[],["auth-failures"],80,30]out[]Turn the fuzzy goal into a bounded agent task. Say what the agent reads, what it may do on its own versus draft for a human, and what it must never touch. Then earn the trust: how you’d verify it before rollout, and the pitch (the problem, what you built, why it matters).
Agent build: design the agent in plain language (or narrate it). The coach grades the decomposition, the guardrails, the verification plan, and the pitch.