Triage & alerts
The durable list of what's wrong right now — computed from the live cache, resolved when the condition clears, alerting even with the app closed.
Triage answers the first question of any incident: what is broken right now? The daemon scans its live cache continuously and keeps a ranked list of findings — each with a severity, what object it's about, what's wrong, since when, and how many pods are caught in it. Toasts nudge you when something new appears; the durable list is this page.
Items resolve themselves. When the crashloop stops or the rollout completes, the finding disappears — there is nothing to dismiss and no stale list to distrust.
What it catches
Pods — crashloop, oom (a container killed for memory), image-pull,
probe-failing, config-error (a missing ConfigMap or Secret reference),
pending (unschedulable), evicted, stuck-terminating, and
restart-spike (restarts climbing fast even between crashes).
Workloads — rollout-stuck, degraded (fewer ready replicas than
desired), no-endpoints (a Service selecting nothing ready), job-failed,
cronjob-suspended, hpa-broken and hpa-maxed (an autoscaler that can't
act, or pinned at its ceiling), pdb-blocked, pvc-pending, and
quota-denied (creations refused by a ResourceQuota).
Cluster — node-notready, node-pressure (memory, disk or PID
pressure), cert-expiring (TLS Secrets nearing their end), and a rollup of
recent warning-events that don't fit a sharper category.
Severity is crit or warn: critical is user-visible breakage or imminent
data loss; warnings are things that will page you later if ignored.
From finding to fix
Every item links to its object — the inspector opens with events, logs and the ownership chain. The Explain button hands the incident brief to the AI SRE, which starts investigating with the context already loaded.
Muting is per finding and it's for the alert, not the truth: a muted item stays on the list, it just stops notifying.
Alerts
Desktop notifications are opt-in (Settings → Desktop notifications) and fire for new critical findings. They're edge-triggered — one alert when a problem appears, one when it resolves, and silence while a flapping condition bounces inside a 30-minute dedupe window. No alert storms.
With Start at login enabled, the daemon keeps watching and alerting while the app is closed. Running headless or in-cluster, the same alerts can POST to a webhook — ntfy, Slack, or anything that accepts JSON.