Rule registry

What the engine is watching for, and what it saw this pass. Every threshold is read live from the registry — retuning a rule is one number in configuration, not a change to any rule's code.

Rule registry

30 rules across 8 modules · 15 fired this pass

Adding a rule is one entry in rules/index.ts. It appears in the stream, the alert feed, the risk register, the summary and this table at once — all six read this array rather than a list maintained beside it.

Mission Control, Integration Hub are registered modules that contribute no rules. The engine reads all 10 modules; Mission Control is a launcher over the other eight and owns no data of its own, so a rule reading it would be reading its sources at one remove. It stays registered rather than omitted so this table can say so.

Companies4

1 fired

Company health below floor
company-health-floor
RiskCriticalAlerts
When
A started workspace's agent-weighted health falls below the company floor.
Then
Intervene on the departments dragging the weighted mean, named individually.
Thresholds it reads — live values
- Company health floor70 /100
This passConditions not met against Companies.
Base confidence 74. Findings may come in under critical priority but never over it.
Blocked projects in a workspace
company-blocked-projects
ThroughputHigh
When
A company workspace holds blocked projects at or above the threshold.
Then
Unblock them, named with their department and owner.
Thresholds it reads — live values
- Blocked projects1 projects
This passFired on 3 subjects.
Base confidence 72. Findings may come in under high priority but never over it.
Workspace generated but not staffed
company-unstaffed
CoverageMedium
When
A company has departments but zero deployed agents across all of them.
Then
Staff it, or close it — a workspace with no agents produces nothing.
This passConditions not met against Companies.
Base confidence 78. Findings may come in under medium priority but never over it.
Most deployed agents are uninstrumented
company-instrumentation-gap
CoverageLow
When
Fewer than a quarter of a workspace's deployed agents appear on its named roster.
Then
Instrument more of the fleet, or read that company's agent figures as a sample.
This passConditions not met against Companies.
Base confidence 60. Findings may come in under low priority but never over it.

Executive Team4

3 fired

Approvals stacked on one executive
executive-approval-backlog
GovernanceHighAlerts
When
Pending approvals on a single executive reach the per-seat backlog threshold.
Then
Hold a review with that seat, high-risk decisions first.
Thresholds it reads — live values
- Executive approval backlog3 approvals per seat
This passFired on 5 subjects.
Base confidence 72. Findings may come in under high priority but never over it.
Executive objectives at risk
executive-objectives-at-risk
RiskHigh
When
At-risk or blocked objectives on a single seat reach the threshold.
Then
Review the seat's commitments — these are the enterprise's own targets.
Thresholds it reads — live values
- At-risk objectives2 objectives
This passFired on 3 subjects.
Base confidence 68. Findings may come in under high priority but never over it.
Seat trailing the leadership layer
executive-seat-underperforming
RiskMedium
When
An executive's score sits more than twelve points below the mean of the bench.
Then
Look at the metrics behind the seat, not the seat.
This passFired on 1 subject.
Base confidence 54. Findings may come in under medium priority but never over it.
Department with no executive owner
executive-unowned-department
CoverageHigh
When
A department on the roster is claimed by no executive seat.
Then
Assign it to a seat — escalation from that department has nowhere to go.
This passConditions not met against Executive Team.
Base confidence 82. Findings may come in under high priority but never over it.

Departments7

2 fired

Department over capacity
department-overloaded
CapacityHighAlerts
When
Mean AI-employee load in a department reaches the overload threshold.
Then
Recommend moving work to the coldest department with headroom, named explicitly.
Thresholds it reads — live values
- Department overloaded85 % mean load
- Department underused45 % mean load
This passConditions not met against Departments.
Base confidence 70. Findings may come in under high priority but never over it.
Operating layer is unbalanced
department-imbalance
CapacityMedium
When
The load gap between the busiest and quietest department exceeds the rebalance spread.
Then
Rebalance across the layer, naming both ends of the gap.
Thresholds it reads — live values
- Rebalance spread30 % points
This passConditions not met against Departments.
Base confidence 58. Findings may come in under medium priority but never over it.
Department health below floor
department-health-floor
RiskCriticalAlerts
When
A department's derived health falls below the health floor.
Then
Intervene on the specific metrics missing target, named individually.
Thresholds it reads — live values
- Department health floor70 /100
This passConditions not met against Departments.
Base confidence 76. Findings may come in under critical priority but never over it.
Objectives at risk in one department
department-objectives-at-risk
RiskHigh
When
At-risk or blocked objectives in a single department reach the threshold.
Then
Recommend an objective review with the accountable executive.
Thresholds it reads — live values
- At-risk objectives2 objectives
This passFired on 2 subjects.
Base confidence 66. Findings may come in under high priority but never over it.
Blocked projects in a department
department-blocked-projects
ThroughputHighAlerts
When
A department reports blocked projects at or above the threshold.
Then
Unblock them — named, with their owners.
Thresholds it reads — live values
- Blocked projects1 projects
This passFired on 3 subjects.
Base confidence 72. Findings may come in under high priority but never over it.
Backlog outgrowing delivery
department-backlog-ratio
CapacityMedium
When
A department's backlog exceeds its active lane by the backlog ratio.
Then
Cut intake or add capacity — the queue will not clear itself.
Thresholds it reads — live values
- Backlog to active ratio2 ×
This passConditions not met against Departments.
Base confidence 56. Findings may come in under medium priority but never over it.
Department with no AI employees
department-unstaffed
CoverageHigh
When
A department exists on the roster with an empty employee list.
Then
Staff it or fold its charter into a department that is staffed.
This passConditions not met against Departments.
Base confidence 82. Findings may come in under high priority but never over it.

Agent Fleet5

5 fired

Idle AI employees available
agent-idle
CapacityMediumAlerts
When
AI employees are in the idle state or at or below the idle load threshold, above the count worth acting on.
Then
Assign them work from the busiest department, named explicitly.
Thresholds it reads — live values
- Agent idle20 % load
- Idle agents worth acting on2 agents
- Department overloaded85 % mean load
This passFired on 1 subject.
Base confidence 66. Findings may come in under medium priority but never over it.
AI employees blocked
agent-blocked
ThroughputHighAlerts
When
Any AI employee reports the blocked state.
Then
Find what each is waiting on — blocked capacity is both unavailable and holding work.
This passFired on 1 subject.
Base confidence 76. Findings may come in under high priority but never over it.
Individual AI employees at capacity
agent-at-capacity
CapacityMedium
When
Individual AI employees sit at or above the per-agent capacity threshold.
Then
Redistribute their work — a department mean will not surface them.
Thresholds it reads — live values
- Agent at capacity80 % load
This passFired on 1 subject.
Base confidence 62. Findings may come in under medium priority but never over it.
Agents with unrestricted tool access
agent-blanket-access
RiskMedium
When
Installed agents holding blanket tool grants exceed the exposure threshold.
Then
Review the grants — a standing exposure, not an incident.
Thresholds it reads — live values
- Blanket tool access3 agents
This passFired on 1 subject.
Base confidence 70. Findings may come in under medium priority but never over it.
Agent short names collide
agent-name-collision
IntegrityLow
When
Two or more installed agents share a short name.
Then
Disambiguate — workflow assignment matches agents by name.
This passFired on 1 subject.
Base confidence 84. Findings may come in under low priority but never over it.

Workflow Engine6

3 fired

Blocked workflow needs escalation
workflow-blocked
ThroughputCriticalAlerts
When
A workflow's execution state is `blocked` — stopped by something outside the workflow itself.
Then
Escalate to the accountable executive with the recorded blocking reason.
Thresholds it reads — live values
- Blocked workflows1 workflows
This passFired on 1 subject.
Base confidence 78. Findings may come in under critical priority but never over it.
Approval gate overdue
workflow-approval-overdue
GovernanceCriticalAlerts
When
A pending gate has been waiting longer than the overdue threshold, measured from its relative timestamp.
Then
Put it in front of the approver, or escalate one authority level up.
Thresholds it reads — live values
- Gate considered overdue48 hours pending
This passConditions not met against Workflow Engine.
Base confidence 72. Findings may come in under critical priority but never over it.
Approval backlog across the estate
workflow-approval-backlog
GovernanceHigh
When
Unresolved gates across every workflow exceed the backlog threshold.
Then
Batch them into one approval session rather than clearing them one at a time.
Thresholds it reads — live values
- Approval backlog3 open gates
This passFired on 1 subject.
Base confidence 64. Findings may come in under high priority but never over it.
Too much of the estate is stalled
workflow-estate-stalled
ThroughputHighAlerts
When
Blocked plus waiting-approval workflows exceed the stalled share of everything in flight.
Then
Run a triage pass across the estate rather than chasing individual workflows.
Thresholds it reads — live values
- Blocked or paused share30 % of live workflows
This passFired on 1 subject.
Base confidence 66. Findings may come in under high priority but never over it.
Scope has grown past plan
workflow-scope-growth
RiskMedium
When
A running workflow's task estimates exceed its stage plan by more than a quarter.
Then
Re-baseline the plan or cut scope before the due date is missed.
This passConditions not met against Workflow Engine.
Base confidence 58. Findings may come in under medium priority but never over it.
Workflow idle behind a decision
workflow-idle-on-decision
GovernanceHigh
When
A live workflow has at least one open gate and no tasks that could start.
Then
Clear the gate — nothing else in that workflow can progress meanwhile.
This passConditions not met against Workflow Engine.
Base confidence 74. Findings may come in under high priority but never over it.

Memory System2

1 fired

Memory retrieval coverage below floor
memory-retrieval-coverage
KnowledgeMedium
When
The share of the memory corpus a vector store could retrieve falls below the coverage floor.
Then
Embed the remainder — an unreachable record behaves like a missing one.
Thresholds it reads — live values
- Memory retrieval coverage75 % of corpus
This passFired on 1 subject.
Base confidence 68. Findings may come in under medium priority but never over it.
Unconfirmed memory accumulating
memory-unconfirmed
KnowledgeMedium
When
Records marked inferred rather than observed exceed the unconfirmed threshold.
Then
Confirm or retire them before agents build on top of them.
Thresholds it reads — live values
- Unconfirmed memory records4 records
This passConditions not met against Memory System.
Base confidence 62. Findings may come in under medium priority but never over it.

Knowledge Graph1

0 fired

Knowledge Graph integrity degraded
graph-integrity
IntegrityMediumAlerts
When
Graph health falls below its floor, or dangling edges are present.
Then
Fix the projections — orphaned nodes and edges to nothing both mean stale keys.
Thresholds it reads — live values
- Graph health floor80 /100
This passConditions not met against Knowledge Graph.
Base confidence 76. Findings may come in under medium priority but never over it.

Communication Hub1

0 fired

Operator notifications unread
comms-unread-signal
GovernanceLow
When
Unread notifications addressed to the operator exceed the threshold.
Then
Triage them, or reduce what raises one.
Thresholds it reads — live values
- Unread notifications6 notifications
This passConditions not met against Communication Hub.
Base confidence 54. Findings may come in under low priority but never over it.

Every threshold21

The complete tuning surface. Retuning a rule is one number here — no rule code, no component and no type changes. A future settings screen writes to this table and nothing else moves.

Department overloaded85 % mean load
Mean AI-employee load at or above this means the department cannot absorb more.
Department underused45 % mean load
Mean load at or below this means capacity is available for rebalancing.
Rebalance spread30 % points
Gap between the hottest and coldest department that justifies moving work.
Agent at capacity80 % load
An individual AI employee at or above this has no slack left.
Agent idle20 % load
An individual AI employee at or below this is available for assignment.
Idle agents worth acting on2 agents
Below this, idle capacity is slack rather than a problem.
Department health floor70 /100
Matches HEALTH_WARN in lib/utils. Below it, attainment is failing.
Company health floor70 /100
Agent-weighted mean of department health. Below it the workspace is struggling.
Blocked workflows1 workflows
Any workflow blocked on something outside itself warrants escalation.
Blocked or paused share30 % of live workflows
Above this share of the live estate stalled, the estate itself is the problem.
Approval backlog3 open gates
Open gates across the estate above which approvals are the bottleneck.
Gate considered overdue48 hours pending
A gate pending longer than this is overdue. Parsed from relative timestamps.
Executive approval backlog3 approvals per seat
Pending approvals on one executive above which that seat is the bottleneck.
At-risk objectives2 objectives
At-risk or blocked objectives in one department that warrant a review.
Blocked projects1 projects
Blocked projects in one department that warrant unblocking.
Backlog to active ratio2 ×
Backlog this many times the active lane means intake outpaces delivery.
Memory retrieval coverage75 % of corpus
Share of memory a vector store could retrieve. Below it, recall is unreliable.
Unconfirmed memory records4 records
Inferred records awaiting confirmation before agents rely on them.
Graph health floor80 /100
Connectedness and integrity of the projected graph, not its size.
Unread notifications6 notifications
Unread operator notifications above which signal is being missed.
Blanket tool access3 agents
Agents holding unrestricted tool grants. A standing exposure, not an incident.