kind: uapf.algorithm.card
id: algo.incident_triage.suggest_priority
version: 1.0.0
name: Priority suggester
intent: |
  Reads the classified incident plus its service-tier and reported
  severity and proposes a priority on the P1..P4 scale. This output is
  a SOFT suggestion only — the priority DMN table makes the binding
  decision, with this suggestion as one of its four input columns.
  Separating "AI suggestion" from "binding decision" keeps the AI
  contestable and the auditor's job tractable.
algorithm_kind: classifier

io:
  inputs:
    - id: severity
      type: string
      constraints:
        enum: [disaster, critical, high, average, warning, low, info]
      documentation: Source-reported severity (Zabbix verbatim; normalised for other adapters).
    - id: service_tier
      type: string
      constraints:
        enum: [tier_1, tier_2, best_effort]
      documentation: Service tier of the affected service (from the connection or host catalog).
    - id: classification
      type: string
      documentation: |
        Taxonomy code from ai.classify@1. The suggester applies a fixed
        elevation for security.incident regardless of severity.
  outputs:
    - id: priority
      type: string
      constraints:
        enum: [P1, P2, P3, P4]
    - id: reason
      type: string
      documentation: One-sentence justification (English). Visible to operator.

implementation:
  type: external
  medium: mcp_tool
  uri: uapf-ip://capability/ai.suggest_priority@1
  hash: sha256:0000000000000000000000000000000000000000000000000000000000000000
  runtime:
    capability: ai.suggest_priority@1
    note: |
      Host-fulfilled UAPF-IP capability. The OpenITSM host can answer
      via either the LLM gateway or a deterministic rule. The DMN
      priority table downstream applies a binding decision on top.

determinism: stochastic
side_effects: pure
complexity:
  typical_latency_ms: 600
  max_latency_ms: 30000
failure_mode: |
  Returns priority='P4' with reason='LLM unavailable, defaulted'. The
  binding DMN can still raise the priority based on severity x tier.

owners:
  - type: team
    id: openitsm-stewards
    contact: stewards@openitsm.algomation.io

lifecycle:
  status: draft

tests:
  - name: disaster-on-tier1-is-p1
    description: |
      Disaster severity on a tier_1 service is always P1 regardless of
      classification.
    inputs:
      severity: "disaster"
      service_tier: "tier_1"
      classification: "network.outage.link_down"
    expected_outputs:
      priority: "P1"
  - name: security-incident-elevates
    description: |
      Security incidents elevate to P1 regardless of severity field.
    inputs:
      severity: "average"
      service_tier: "tier_2"
      classification: "security.incident"
    expected_outputs:
      priority: "P1"
  - name: customer-request-low
    description: |
      A customer service request on best_effort tier is P4 unless
      escalated by an operator.
    inputs:
      severity: "info"
      service_tier: "best_effort"
      classification: "service.customer_request"
    expected_outputs:
      priority: "P4"