Niklas Ye
b114251f45
Users get a notification_channels table (replacing users.ntfy_topic); pages fan
out to every enabled channel through a notify.Provider registry, with ntfy as
the first provider. Fallbacks are typed {type, address}. Schema edited in place:
existing databases must be recreated.
Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
2.4 KiB
Escalation
Escalation ladders: who is paged next when nobody acknowledges. Back to the README and the documentation index.
Without a ladder, an unacknowledged incident re-pages the same topic every
notify_repeat forever. That is a louder version of the same silence: if the
person on call is asleep, out of signal, or has left, nothing else happens.
A team can configure an ordered ladder instead. Each level has a timeout and a set of targets, and a target is either a named person or whoever the team's rota says is on call today — the target that keeps working when the rota changes and nobody remembers to edit the policy.
level 1 5m oncall the rota gets first refusal
level 2 5m user:bob then a named second
then repeat_count more rounds
then the team's fallback, once
When a level's timeout passes with the incident still triggered, the next
level is paged. Off the end of the ladder the whole thing runs again
repeat_count times, and after that the team's fallback is paged once
as the end of the line. The incident stays open throughout: running out of
people to wake is not the same as somebody answering.
Acknowledging or resolving stops it, which is the point — continuing to wake people after somebody has said "I have this" is how a tool teaches people to mute it. Snoozing pauses it: a deliberate "not now" holds the ladder where it is, and it resumes when the snooze runs out.
Every step is on the incident's timeline with the level and the names it woke,
so somebody reading it afterwards can tell why their phone rang at 04:00. A
level whose targets are all unreachable — no notification channel, a disabled account, an
empty rota — is recorded as nobody reachable and the ladder moves on rather
than stalling on a rung that cannot ring.
Reminders and escalation never both run. A team with a ladder gets escalation; a team without keeps the reminder behaviour exactly as it was. Two pages for one silence is the surest way to get a tool muted.
The ladder's fallback is per team and names a provider and an address
({"type": "ntfy", "address": "..."}), unlike TERDUT_NTFY_FALLBACK_TOPIC,
which is the install-wide ntfy topic used when an incident opens with nobody on call.
They answer different questions: one is "nobody was scheduled", the other is
"everybody scheduled has been tried".