Alert event sink: emit safe quant/error notifications for desktop consumers #57

New issue

Open

opened 2026-09-07 03:14:17 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-07 03:14:17 +00:00

Owner

Goal

Expose llm-log anomaly/routing alerts through a generic safe event sink so desktop configuration can notify without coupling core llm-log to Dunst.

Depends on #57/#58; configurable through #59.

Contract

Emit compact typed alert events containing only safe metadata by default:

event id
timestamp
severity
detector/rule id
provider
model
disclosed quantization (unknown when undisclosed)
anomaly classes / score
HTTP/router error status when applicable

Do not put raw prompts, completions, auth headers or tool arguments into notification payloads.

Support at least:

append-only alerts.jsonl under the llm-log data directory;
optional argv-based command hook with fields passed as environment variables or fixed positional arguments, never shell-interpolated strings;
rate limiting/deduplication so one pathological stream does not notification-storm the desktop;
observe-only default: alerts never block proxy traffic.

Acceptance

deterministic alert fixtures;
no secret/raw-content leakage;
command hook uses exec argv, not shell=True;
repeated identical anomaly events are coalesced within configured window;
hook failure is recorded but never breaks forwarding;
Home Manager can wire notify-send/Dunst without llm-log depending on a desktop stack.

## Goal Expose llm-log anomaly/routing alerts through a generic safe event sink so desktop configuration can notify without coupling core llm-log to Dunst. Depends on #57/#58; configurable through #59. ## Contract Emit compact typed alert events containing only safe metadata by default: - event id - timestamp - severity - detector/rule id - provider - model - disclosed quantization (`unknown` when undisclosed) - anomaly classes / score - HTTP/router error status when applicable Do not put raw prompts, completions, auth headers or tool arguments into notification payloads. Support at least: - append-only `alerts.jsonl` under the llm-log data directory; - optional argv-based command hook with fields passed as environment variables or fixed positional arguments, never shell-interpolated strings; - rate limiting/deduplication so one pathological stream does not notification-storm the desktop; - observe-only default: alerts never block proxy traffic. ## Acceptance - deterministic alert fixtures; - no secret/raw-content leakage; - command hook uses exec argv, not `shell=True`; - repeated identical anomaly events are coalesced within configured window; - hook failure is recorded but never breaks forwarding; - Home Manager can wire `notify-send`/Dunst without llm-log depending on a desktop stack.

nsaspy referenced this issue

2026-09-07 03:14:17 +00:00

Quant anomaly detector: score output pathologies without inventing bit-width certainty #59

nsaspy referenced this issue

2026-09-07 03:44:57 +00:00

Observe OpenRouter provider and quantization metadata #64