Niklas Ye
b114251f45
Users get a notification_channels table (replacing users.ntfy_topic); pages fan
out to every enabled channel through a notify.Provider registry, with ntfy as
the first provider. Fallbacks are typed {type, address}. Schema edited in place:
existing databases must be recreated.
Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
47 lines
2.4 KiB
Markdown
47 lines
2.4 KiB
Markdown
# Escalation
|
|
|
|
_Escalation ladders: who is paged next when nobody acknowledges._ Back to the [README](../README.md) and the [documentation index](./README.md).
|
|
|
|
Without a ladder, an unacknowledged incident re-pages the same topic every
|
|
`notify_repeat` forever. That is a louder version of the same silence: if the
|
|
person on call is asleep, out of signal, or has left, nothing else happens.
|
|
|
|
A team can configure an ordered ladder instead. Each level has a timeout and a
|
|
set of targets, and a target is either a named person or **whoever the team's
|
|
rota says is on call today** — the target that keeps working when the rota
|
|
changes and nobody remembers to edit the policy.
|
|
|
|
```
|
|
level 1 5m oncall the rota gets first refusal
|
|
level 2 5m user:bob then a named second
|
|
then repeat_count more rounds
|
|
then the team's fallback, once
|
|
```
|
|
|
|
When a level's timeout passes with the incident still `triggered`, the next
|
|
level is paged. Off the end of the ladder the whole thing runs again
|
|
`repeat_count` times, and after that the team's `fallback` is paged once
|
|
as the end of the line. The incident stays open throughout: running out of
|
|
people to wake is not the same as somebody answering.
|
|
|
|
**Acknowledging or resolving stops it**, which is the point — continuing to wake
|
|
people after somebody has said "I have this" is how a tool teaches people to
|
|
mute it. **Snoozing pauses it**: a deliberate "not now" holds the ladder where
|
|
it is, and it resumes when the snooze runs out.
|
|
|
|
Every step is on the incident's timeline with the level and the names it woke,
|
|
so somebody reading it afterwards can tell why their phone rang at 04:00. A
|
|
level whose targets are all unreachable — no notification channel, a disabled account, an
|
|
empty rota — is recorded as `nobody reachable` and the ladder moves on rather
|
|
than stalling on a rung that cannot ring.
|
|
|
|
**Reminders and escalation never both run.** A team with a ladder gets
|
|
escalation; a team without keeps the reminder behaviour exactly as it was. Two
|
|
pages for one silence is the surest way to get a tool muted.
|
|
|
|
The ladder's `fallback` is per team and names a provider and an address
|
|
(`{"type": "ntfy", "address": "..."}`), unlike `TERDUT_NTFY_FALLBACK_TOPIC`,
|
|
which is the install-wide ntfy topic used when an incident opens with nobody on call.
|
|
They answer different questions: one is "nobody was scheduled", the other is
|
|
"everybody scheduled has been tried".
|