Engineering Copilot: Anomaly Triage

Ranking, deduplicating, and root-causing the anomaly flags raised by L3 ensembles so operators see prioritized, explained events rather than a raw alert stream.

From raw flags to actionable events

The L3 anomaly-detection ensembles emit many flags — autoencoder residual spikes, subthreshold threshold crossings, precursor detections. Left raw, these overwhelm operators. The Engineering Copilot's triage function clusters correlated flags into a single event, ranks events by severity and lead time, attributes a probable root cause, and recommends a response.

Triage pipeline

triage(flags):
  events = cluster(flags by time, location, correlation)
  for e in events:
    e.severity  = f(margin_erosion, rate, affected_subsystem)
    e.lead_time = anomaly.precursor_lead_time(e)
    e.cause     = attribute(e, retrieve(similar_past_faults))
    e.response  = recommend(e.cause)      # proposal only
  return sort(events, key=severity*urgency)

Severity and lead-time reasoning

Severity combines how fast a margin is eroding, which subsystem is affected, and whether the event sits on a safety-relevant path. Lead time is drawn from the L3 precursor models — a REBCO quench precursor with tens of milliseconds of warning is handled by hardware, while a slow magnet delta-T drift with hours of lead time is a maintenance item. The copilot routes each event to the appropriate timescale and owner.

Triage recommendations are proposals. A response that changes a setpoint or arms a mitigation is routed through L4 authorization; the copilot cannot execute mitigations itself, and genuine fast protection stays in hardware. Every triaged event carries its constituent flags, the retrieved similar past faults, and the attribution confidence so an operator can verify the reasoning. Triage output feeds maintenance reasoning for anything requiring intervention.