Triage cloud cost spikes before anyone is paged

Agent buildEasy10 minAmazon style

Your task

Finance flags your cloud bill after every spike, and someone burns a day tracing the cause. An agent triages each spike so that only big, explained ones page anyone.

Write triage_cost_anomalies(spike_rows, expected_events, alert_threshold_pct): the rule your agent follows for each spike.

spike_rows (list of str): one spike each, written service|pct_increase|attribution|date, for example "payments|42.0|deploy-1841|2026-01-31". The attribution is the change event behind the spike, or none.
expected_events (list of str): announced spend, such as a launch or a backfill, each written service@date.
alert_threshold_pct (float): the smallest increase worth an alert.
Return one verdict per row, in input order.

Fields are used exactly as written, and the increase is a number. Rules, for each row:

If it does not split on | into exactly 4 fields: "malformed".
If service@date is one of expected_events: "expected:<service>".
If the increase is below alert_threshold_pct: "digest:<service>".
If the attribution is none: "unattributed:<service>".
Otherwise: "alert:<service>:<attribution>".

Examples

triage_cost_anomalies(spike_rows: list[str], expected_events: list[str], alert_threshold_pct: float) -> list[str]

Example 1

Input

triage_cost_anomalies(["payments|42.0|deploy-1841|2026-01-31", "search|6.0|deploy-1902|2026-01-31", "ledger|55.0|none|2026-02-01"], ["checkout@2026-01-31"], 25)

Output["alert:payments:deploy-1841", "digest:search", "unattributed:ledger"]

Example 2

Inputtriage_cost_anomalies(["checkout|80.0|backfill-77|2026-02-02"], ["checkout@2026-02-02"], 25)

Output["expected:checkout"]

Example 3

Inputtriage_cost_anomalies(["media|25.0|deploy-2001|2026-02-03"], [], 25)

Output["alert:media:deploy-2001"]