Project notebook / SIRQ

Less noise. Keep the important signals.

SIRQ explores which alerts are worth an interruption. Shadow Mode compares a proposed policy with the existing alert path—without taking production action.

Inspect the source ↗Walk through the demo ↓

Demo, not a production result. The nine-alert fixture below is a static, simulated night. The current evaluator is a deterministic mock. There are no external calls or production credentials, and Shadow Mode does not mute, route, remediate, or change production.

One bad night. Two different thresholds.

00:00–04:00 / Simulated fixture

The existing path treats every alert as a reason to wake an engineer. The comparison asks which signals carry enough consequence to justify that interruption.

Existing wake-ups
9
Proposed wake-ups
2
Production actions
0

Existing alert path

Every event pages.

  1. 00:18 CI runner CPU spike Paged
  2. 00:42 Redis latency spike Paged
  3. 01:07 Redis recovered Paged
  4. 01:31 Image worker restart Paged
  5. 02:04 Checkout errors at 7% Paged
  6. 02:18 Checkout failing at 11% Paged
  7. 02:41 Same checkout incident Paged
  8. 03:12 Worker healthy again Paged
  9. 03:48 TLS certificate expires in 18h Paged

SIRQ / Shadow Mode

Same events, triaged.

Expand an event to inspect the reasoning.

00:18 CI runner CPU spike routine

A short-lived build burst returned to baseline without customer impact.

00:42 Redis latency spike routine

Latency rose briefly, then recovered before the request path degraded.

01:07 Redis recovered routine

A recovery event is useful context, not a second reason to wake someone.

01:31 Image worker restart routine

The worker restarted and resumed its queue without a sustained backlog.

02:04 Checkout errors at 7% routine

The first error burst was below the configured consequence threshold.

02:18 Checkout failing at 11% interrupt

This crossed the high-consequence threshold and would wake the on-call engineer.

02:41 Same checkout incident duplicate

A duplicate signal is attached to the active incident instead of creating another wake-up.

03:12 Worker healthy again routine

Recovery is recorded for the timeline; it does not page the sleeping engineer.

03:48 TLS certificate expires in 18h interrupt

The expiry window is actionable before the next deploy, so it remains visible as an interruption.

Seven fewer proposed interruptions out of nine: a 77.8% reduction in this fixture only. This is a counterfactual, not a measured production outcome.

The architecture

Interpretation is not authority.

Adapters bring in logs, metrics, webhooks, and agent state. A semantic evaluator names what appears to be happening; deterministic policy decides whether to record, show, or notify.

Raw events → Semantic signal → Deterministic policy

Try it locally

Replay the night.

Run the local on-call demo to generate a standalone report. No production access is needed. 

git clone https://github.com/suttonwilliamd/SIRQ
cd SIRQ
python -m sirq.cli oncall-demo --output sirq-one-bad-night.html