feat(agent-workspace): add notification SLO governance

Jacobinwwey · Jacobinwwey · commit 9bec93dac340 · 2026-04-16T11:44:08.000-05:00
diff --git a/docs/brainstorms/2026-04-16-mainline-ci-stabilization-and-m7-direction-requirements.md b/docs/brainstorms/2026-04-16-mainline-ci-stabilization-and-m7-direction-requirements.md
@@ -643,6 +643,36 @@ Deliverables:
   - `npm run test:agent-workspace:contracts`
   - `npm run verify:agent-workspace:runtime`
 
+### M7.21 (Now): Notification Escalation SLOs and Anomaly-Threshold Governance (Lane Ops Bridge)
+
+Deliverables:
+
+- add bounded notification SLO report route for operator governance review.
+- expose anomaly-threshold policy explicitly instead of keeping thresholds implicit in helper logic.
+- keep breach synthesis deterministic from current notification trail state.
+
+#### M7.21 Progress Note (2026-04-16)
+
+- [Done] expanded `src/server.ts` with notification SLO route:
+  - `GET /api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-slo?limit=...`.
+- [Done] expanded notification-policy output:
+  - `/triage/remediation/escalation/notification-policy` now includes `anomalyThresholdPolicy`.
+- [Done] added deterministic anomaly-threshold/SLO helper stack:
+  - `getAgentWorkspaceDiagnosticsRemediationEscalationNotificationAnomalyThresholdPolicy(...)`,
+  - `buildAgentWorkspaceDiagnosticsRemediationEscalationNotificationSloReport(...)`.
+- [Done] SLO breach synthesis now covers at least:
+  - suppressed notification count threshold,
+  - throttled digest count threshold,
+  - suppressed-to-emitted ratio threshold.
+- [Done] expanded evidence coverage:
+  - `src/server.migration.test.ts` now validates anomaly-threshold policy payload and notification SLO route semantics.
+  - `src/knowledge.api.contract.test.ts` now fail-fast checks notification-slo route contract.
+  - `src/agent_workspace.verification.contract.test.ts` + `scripts/verify-agent-workspace-runtime.js` now fail fast on SLO/threshold helper and route drift.
+- [Done] verification evidence:
+  - `npm test -- src/server.migration.test.ts --runInBand --testNamePattern "escalation notification SLOs and anomaly-threshold governance stay deterministic"`
+  - `npm run test:agent-workspace:contracts`
+  - `npm run verify:agent-workspace:runtime`
+
 ## Success Criteria
 
 - CI failure mode that previously blocked the three agent-workspace suites is eliminated on mainline.
@@ -652,4 +682,4 @@ Deliverables:
 
 ## Next Step
 
-Proceed to `/prompts:ce-plan` using this document as the source for `M7.21` decomposition (notification escalation SLOs and anomaly-threshold governance), while preserving M7 lane boundary constraints.
+Proceed to `/prompts:ce-plan` using this document as the source for `M7.22` decomposition (notification threshold overrides and audit-trail governance), while preserving M7 lane boundary constraints.
diff --git a/docs/diataxis/en/explanation/development-progress-dashboard.md b/docs/diataxis/en/explanation/development-progress-dashboard.md
@@ -599,6 +599,25 @@ Execution anchor:
   - `npm run test:agent-workspace:contracts`
   - `npm run verify:agent-workspace:runtime`
 
+## Latest Mainline Increment (2026-04-16 M7.21 Notification Escalation SLOs and Anomaly-Threshold Governance Lane)
+
+- Expanded `src/server.ts` with notification SLO route:
+  - `GET /api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-slo?limit=...`.
+- Expanded notification governance payload:
+  - `/triage/remediation/escalation/notification-policy` now includes explicit `anomalyThresholdPolicy`.
+- Added deterministic notification SLO synthesis:
+  - suppression-count warning threshold,
+  - throttled-digest warning threshold,
+  - suppressed-to-emitted ratio warning threshold.
+- Expanded executable evidence:
+  - `src/server.migration.test.ts` now validates anomaly-threshold policy payload and notification SLO route semantics.
+- Hardened runtime verification gate:
+  - `src/knowledge.api.contract.test.ts`, `src/agent_workspace.verification.contract.test.ts`, and `scripts/verify-agent-workspace-runtime.js` now fail fast on notification-slo route and anomaly-threshold/SLO helper drift.
+- Verification evidence:
+  - `npm test -- src/server.migration.test.ts --runInBand --testNamePattern \"escalation notification SLOs and anomaly-threshold governance stay deterministic\"`
+  - `npm run test:agent-workspace:contracts`
+  - `npm run verify:agent-workspace:runtime`
+
 ## Mainline vs Working-Branch Snapshot (2026-04-14)
 
 | Capability Slice | Working Branch (`feat/learning-multi-tutor-adapter`) | Mainline (`origin/main`) | Integration Status |
@@ -647,7 +666,7 @@ This dashboard aligns against the following requirement chain:
 | L2 Retrieval | explainable hybrid/vector retrieval + governance | Expanded in branch-oriented plans | Mainline file-backed baseline only (`src/learning/store.ts`) | Re-enter lane after concrete module evidence lands on mainline |
 | L3 Learning | mastery diagnostics + path/session loop | Expanded in branch | Partially integrated | Contract and integration parity |
 | L4 Interaction | agent conversation + focus/path pane runtime | Implemented in branch | M1-M4 baseline integrated on mainline | Expand capability surface via typed contract only |
-| L5 Governance | runbook, diagnostics, replay/autonomy controls | Expanded in branch | Operator diagnostics persistence/triage/history/threshold governance + runbook automation/audit + adaptive simulation/remediation + remediation backtest/approval-gate + approval-policy hardening/regression-alarms + approval-policy drift/escalation + escalation acknowledgement lifecycle/audit + escalation SLA/reminder baseline + notification digest/suppression baseline + delivery-log observability + stale-cleanup health auditing + anomaly/retention governance integrated | M7.21: notification escalation SLOs and anomaly-threshold governance |
+| L5 Governance | runbook, diagnostics, replay/autonomy controls | Expanded in branch | Operator diagnostics persistence/triage/history/threshold governance + runbook automation/audit + adaptive simulation/remediation + remediation backtest/approval-gate + approval-policy hardening/regression-alarms + approval-policy drift/escalation + escalation acknowledgement lifecycle/audit + escalation SLA/reminder baseline + notification digest/suppression baseline + delivery-log observability + stale-cleanup health auditing + anomaly/retention governance + notification SLO governance integrated | M7.22: notification threshold overrides and audit-trail governance |
 
 ## Verification Baseline
 
diff --git a/docs/diataxis/zh/explanation/development-progress-dashboard.md b/docs/diataxis/zh/explanation/development-progress-dashboard.md
@@ -601,6 +601,25 @@
   - `npm run test:agent-workspace:contracts`
   - `npm run verify:agent-workspace:runtime`
 
+## 主线最新增量（2026-04-16 M7.21 通知升级 SLO 与异常阈值治理链路）
+
+- 已在 `src/server.ts` 增加通知 SLO 路由：
+  - `GET /api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-slo?limit=...`。
+- 已扩展通知治理输出：
+  - `/triage/remediation/escalation/notification-policy` 现在输出显式 `anomalyThresholdPolicy`。
+- 已新增确定性通知 SLO 合成：
+  - suppressed count 告警阈值，
+  - throttled digest 告警阈值，
+  - suppressed-to-emitted ratio 告警阈值。
+- 已补可执行证据：
+  - `src/server.migration.test.ts` 新增 anomaly-threshold policy 载荷与 notification SLO 路由语义断言。
+- 已加固 runtime 门禁：
+  - `src/knowledge.api.contract.test.ts`、`src/agent_workspace.verification.contract.test.ts` 与 `scripts/verify-agent-workspace-runtime.js` 新增 notification-slo 路由与 anomaly-threshold/SLO helper 的 fail-fast 断言。
+- 验证证据：
+  - `npm test -- src/server.migration.test.ts --runInBand --testNamePattern \"escalation notification SLOs and anomaly-threshold governance stay deterministic\"`
+  - `npm run test:agent-workspace:contracts`
+  - `npm run verify:agent-workspace:runtime`
+
 ## 主线 vs 工作分支快照（2026-04-14）
 
 | 能力切片 | 工作分支（`feat/learning-multi-tutor-adapter`） | 主线（`origin/main`） | 集成状态 |
@@ -649,7 +668,7 @@
 | L2 检索层 | 可解释混合/向量检索 + 治理 | 分支规划增强中 | 主线当前为 file-backed 基线（`src/learning/store.ts`） | 待主线出现对应模块证据后再收敛 |
 | L3 学习层 | 掌握诊断 + 路径/会话闭环 | 分支增强中 | 主线部分集成 | 契约与集成一致性 |
 | L4 交互层 | agent 对话 + focus/path pane 运行时 | 分支已实现 | 主线 M1-M4 已落入基线 | 继续通过 typed contract 扩展动作面 |
-| L5 治理层 | runbook/诊断/回放与自动化 | 分支增强中 | 主线已集成运维诊断持久化/分级/趋势历史/阈值治理 + runbook 自动化/阈值审计 + 自适应模拟/自动修复 + 回测/批准门禁 + 批准策略硬化/回归告警 + 批准策略漂移/升级 + 升级确认生命周期/审计 + 升级 SLA/提醒基线 + 通知摘要/抑制基线 + 交付日志可观测性 + 陈旧通知健康审计 + 异常/retention 治理 | M7.21：通知升级 SLO 与异常阈值治理 |
+| L5 治理层 | runbook/诊断/回放与自动化 | 分支增强中 | 主线已集成运维诊断持久化/分级/趋势历史/阈值治理 + runbook 自动化/阈值审计 + 自适应模拟/自动修复 + 回测/批准门禁 + 批准策略硬化/回归告警 + 批准策略漂移/升级 + 升级确认生命周期/审计 + 升级 SLA/提醒基线 + 通知摘要/抑制基线 + 交付日志可观测性 + 陈旧通知健康审计 + 异常/retention 治理 + 通知 SLO 治理 | M7.22：通知阈值覆盖与审计轨迹治理 |
 
 ## 验证基线
 
diff --git a/scripts/verify-agent-workspace-runtime.js b/scripts/verify-agent-workspace-runtime.js
@@ -172,6 +172,10 @@ function verifyAgentWorkspaceRuntime(repoRoot = path.resolve(__dirname, '..')) {
     serverSource.includes('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-anomalies'),
     'Missing diagnostics remediation escalation notification anomalies route in src/server.ts'
   );
+  assert(
+    serverSource.includes('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-slo'),
+    'Missing diagnostics remediation escalation notification SLO route in src/server.ts'
+  );
   assert(
     serverSource.includes('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/digest'),
     'Missing diagnostics remediation escalation digest route in src/server.ts'
@@ -308,10 +312,18 @@ function verifyAgentWorkspaceRuntime(repoRoot = path.resolve(__dirname, '..')) {
     serverSource.includes('getAgentWorkspaceDiagnosticsRemediationEscalationNotificationRetentionPolicy'),
     'Missing remediation escalation notification retention policy helper in src/server.ts'
   );
+  assert(
+    serverSource.includes('getAgentWorkspaceDiagnosticsRemediationEscalationNotificationAnomalyThresholdPolicy'),
+    'Missing remediation escalation notification anomaly threshold helper in src/server.ts'
+  );
   assert(
     serverSource.includes('buildAgentWorkspaceDiagnosticsRemediationEscalationNotificationAnomalyReport'),
     'Missing remediation escalation notification anomaly report helper in src/server.ts'
   );
+  assert(
+    serverSource.includes('buildAgentWorkspaceDiagnosticsRemediationEscalationNotificationSloReport'),
+    'Missing remediation escalation notification SLO report helper in src/server.ts'
+  );
   assert(
     serverSource.includes('applyAgentWorkspaceDiagnosticsRemediationEscalationReminderSuppressionPolicy'),
     'Missing remediation escalation reminder suppression policy helper in src/server.ts'
@@ -379,14 +391,14 @@ function verifyAgentWorkspaceRuntime(repoRoot = path.resolve(__dirname, '..')) {
       'diagnostics remediation policy drift route exists',
       'diagnostics remediation escalation route exists',
       'diagnostics remediation escalation SLA/reminder routes exist',
-      'diagnostics remediation escalation notification policy, log, health, anomaly, and digest routes exist',
+      'diagnostics remediation escalation notification policy, log, health, anomaly, SLO, and digest routes exist',
       'diagnostics remediation escalation acknowledgement routes exist',
       'diagnostics remediation approval routes exist',
       'diagnostics triage remediation route exists',
       'diagnostics retention governance exists',
       'diagnostics alert-threshold governance helpers exist',
       'diagnostics threshold simulation, drift, remediation, escalation, and SLA helpers exist',
-      'diagnostics escalation notification, digest cadence, reminder suppression, delivery-log, health, and anomaly helpers exist',
+      'diagnostics escalation notification, digest cadence, reminder suppression, delivery-log, health, anomaly, and SLO helpers exist',
       'diagnostics remediation policy and alarm helpers exist',
       'diagnostics threshold audit helpers exist',
       'diagnostics remediation approval trail helpers exist',
diff --git a/src/agent_workspace.verification.contract.test.ts b/src/agent_workspace.verification.contract.test.ts
@@ -66,6 +66,7 @@ describe('agent workspace verification script contracts', () => {
     expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notifications');
     expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-health');
     expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-anomalies');
+    expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-slo');
     expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/digest');
     expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/acknowledge');
     expect(runtimeSource).toContain('/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/approvals');
@@ -99,6 +100,8 @@ describe('agent workspace verification script contracts', () => {
     expect(runtimeSource).toContain('buildAgentWorkspaceDiagnosticsRemediationEscalationNotificationHealthReport');
     expect(runtimeSource).toContain('getAgentWorkspaceDiagnosticsRemediationEscalationNotificationRetentionPolicy');
     expect(runtimeSource).toContain('buildAgentWorkspaceDiagnosticsRemediationEscalationNotificationAnomalyReport');
+    expect(runtimeSource).toContain('getAgentWorkspaceDiagnosticsRemediationEscalationNotificationAnomalyThresholdPolicy');
+    expect(runtimeSource).toContain('buildAgentWorkspaceDiagnosticsRemediationEscalationNotificationSloReport');
     expect(runtimeSource).toContain('applyAgentWorkspaceDiagnosticsRemediationEscalationReminderSuppressionPolicy');
     expect(runtimeSource).toContain('buildAgentWorkspaceDiagnosticsRemediationEscalationGovernanceContext');
     expect(runtimeSource).toContain('acknowledgeAgentWorkspaceDiagnosticsRemediationEscalation');
diff --git a/src/knowledge.api.contract.test.ts b/src/knowledge.api.contract.test.ts
@@ -30,6 +30,7 @@ describe('Knowledge mastery API contract wiring', () => {
             '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notifications',
             '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-health',
             '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-anomalies',
+            '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/notification-slo',
             '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/digest',
             '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/escalation/acknowledge',
             '/api/knowledge/operator/agent-workspace-diagnostics/triage/remediation/approvals',
diff --git a/src/server.migration.test.ts b/src/server.migration.test.ts
diff --git a/src/server.ts b/src/server.ts
