incident-triage/docs/overview.md

lv.itsm.incident.triage — overview

Level-4 UAPF process for triaging IT-infrastructure incidents at LVRTC.

What it does

A new Signal lands in OpenITSM (Zabbix webhook, IMAP poll, Jira DC webhook, manual entry). The host opens a Case and starts a session of this package against the UAPF engine. The engine then drives the linear flow defined in bpmn/incident-triage.bpmn, calling back to OpenITSM at every step:

1. Normalize the source-specific payload to a uniform shape.
2. Classify into one of nine taxonomy codes (LLM + regex fallback).
3. Suggest a soft P1..P4 priority.
4. Evaluate the three DMN tables in order: priority (binding), ownership (LVRTC vs external), routing (which expert group).
5. Update the case with the decided priority + group + status=triaged.
6. Draft a parallel Latvian + English customer notification — flagged PROPOSED, requires operator approval before send.
7. Emit the closing routed CaseEvent.

Why the split

Classification, priority suggestion, and customer-response drafting are the AI steps. Everything binding — the actual priority, who handles it, which group — lives in versioned DMN, not in Python. That keeps the AI contestable and the auditor's job tractable: an evaluator can read dmn/priority.dmn and know exactly what priority an incident will receive, given its severity and tier, without running anything.

Cornerstones

• bpmn/ — incident-triage.bpmn — 1 process, 9 service tasks, linear.
• dmn/ — priority.dmn (14 rules), ownership.dmn (6 rules), routing.dmn (14 rules), all FIRST hit-policy.
• algorithms/ — 7 algorithm cards, each with embedded v2.5.0 tests.
• resources/ — guardrails (PII, approval gating, timeouts, retention) and host mappings (expert groups, service tiers, taxonomy).
• metadata/ — lifecycle + ownership.

Versioning

This package targets UAPF v2.5.0 (track main, refreshed on every schema release). Breaking changes follow the spec's CHANGELOG.

Host requirements

OpenITSM must implement and advertise (via /uapf/host/manifest) the seven UAPF-IP capabilities listed in requires_capabilities:

• intake.normalize@1
• ai.classify@1
• ai.suggest_priority@1
• ai.draft_response@1
• dmn.evaluate@1
• incident.update@1
• event.emit@1

The first six are intent-bearing (each governed by its own Algorithm Card); event.emit is an append-only timeline writer.