investigate

type CloudResourceHealthTool struct {
	Cloud providers.CloudProvider
}

type CloudWhatChangedTool struct {
	Cloud providers.CloudProvider
}

type ControllerLogsTool struct {
	Logs providers.LogReader
}

type Debouncer struct {
	// contains filtered or unexported fields
}

type Enqueuer interface {
	Enqueue(r Request)
}

type GitOpsStatusTool struct {
	Inspector providers.GitOpsInspector
}

type GitOpsTreeTool struct {
	Inspector providers.GitOpsInspector
}

type Investigator interface {
	Investigate(ctx context.Context, r Request) error
}

type KBSearchTool struct {
	Catalog catalog.Searcher
}

type KubeEventsTool struct {
	Kube providers.KubeReader
}

type LogInvestigator struct {
	Log *slog.Logger
}

type LoopInvestigator struct {
	Model      providers.ModelProvider
	Tools      []Tool
	Log        *slog.Logger
	MaxSteps   int
	OnComplete func(providers.Investigation) // delivery hook (Slack/Matrix later)
	Actions    *action.Policy                // autonomy ladder; nil/off = read-only findings only
	Recall     *Recall                       // optional: short-circuit on a high-confidence catalog hit
	Verify     bool                          // run an adversarial review of root causes before delivery

	// VerifyModel optionally routes the adversarial verify pass to a cheaper/faster
	// model. nil ⇒ the verify pass reuses Model. Verify itself always runs.
	VerifyModel providers.ModelProvider

	// Timeout bounds a single investigation end-to-end (recall + every model/tool
	// call, including a hung git clone/patch). 0 disables it. On expiry the loop
	// delivers a synthetic timeout result rather than starving the queue worker.
	Timeout time.Duration

	// ToolTimeout bounds a SINGLE tool call so one hung/slow provider (a stuck git
	// clone, an unresponsive metrics/logs endpoint) can't consume the whole
	// per-investigation budget. On expiry runTool returns a clear, NON-fatal "timed
	// out" string that becomes the tool result and the loop continues. 0 disables it
	// (tool calls then share only the per-investigation Timeout). Defaulted at
	// construction (see internal/app/investigate.go).
	ToolTimeout time.Duration

	// Cost controls (0 means disabled/unlimited):
	MaxToolOutputBytes        int // truncate tool results larger than this before adding to history
	MaxTokensPerInvestigation int // inject a budget-nudge message when the estimated token count exceeds this

	// Compaction selects how mid-loop history compaction treats the tool outputs it
	// elides: "" / "elide" (default) drops their bodies for markers; "summarize" first
	// asks a model for one compact factual digest of the batch and keeps that in place
	// of the markers, falling back to plain elision on any summarizer failure. When
	// "summarize", the digest call is routed to VerifyModel if set, else Model.
	Compaction string

	// Observability — nil-safe; no-op when telemetry is disabled.
	Metrics       *telemetry.Metrics
	ModelProvider string // label for model_requests/model_request_duration metrics (e.g. "anthropic")

	// OnProgress, when set, receives an interim progress snapshot every
	// ProgressEverySteps steps of a long investigation. It is nil-safe and
	// default-off (nil ⇒ never called; zero extra model calls). The callback must
	// never fail the investigation: the app wires it to a best-effort delivery that
	// logs and swallows its own errors. The interim text passed is already
	// secret-redacted at this egress boundary.
	OnProgress func(providers.ProgressUpdate)
	// ProgressEverySteps is the cadence for OnProgress. <= 0 disables progress
	// pings even when OnProgress is set.
	ProgressEverySteps int

	// Pricing (optional) estimates a per-investigation cost from the accumulated
	// token totals. nil ⇒ token totals are still reported but no cost is shown.
	// VerifyPricing prices the adversarial verify pass's tokens; nil ⇒ it inherits
	// Pricing (so a cheaper verify model is costed correctly when configured).
	Pricing       *Pricing
	VerifyPricing *Pricing
}

type NetworkDropsTool struct {
	Network providers.NetworkProvider
}

type OutcomeStats interface {
	OpenCounts() (map[string]outcome.Aggregate, error)
}

type PodLogsTool struct {
	Logs providers.LogReader

	// IncidentNamespace is the namespace of the workload under investigation; it is
	// always permitted. Set per-investigation by the loop from req.Workload.Namespace.
	IncidentNamespace string

	// AllowedNamespaces is the operator-configured allowlist of extra namespaces
	// pod_logs may read (config.investigation.pod_log_namespaces). Empty ⇒ the
	// incident namespace is the only permitted namespace (secure by default).
	AllowedNamespaces []string
}

type PodStatusTool struct {
	Kube providers.KubeReader
}

type Pricing struct {
	InputUSDPerMTok       float64
	OutputUSDPerMTok      float64
	CachedInputUSDPerMTok float64
}

type QueryLogsTool struct {
	Logs providers.LogsProvider
}

type QueryMetricsRangeTool struct {
	Metrics providers.MetricsProvider
}

type QueryMetricsTool struct {
	Metrics providers.MetricsProvider
}

type Queue struct {
	// contains filtered or unexported fields
}

type Recall struct {
	Catalog              catalog.ScoredSearcher
	MinScore             float64 // similarity floor for the top hit
	MarginGap            float64 // top hit must beat the runner-up by at least this
	SoloFloor            float64 // confident bar when there is only one hit
	RequireWorkloadMatch bool    // true = exact namespace+workload; false = namespace-level agreement is enough

	// Hybrid, when non-nil AND it has vectors, switches recall to fused BM25+embedding
	// retrieval gated on COSINE similarity (HybridMinScore / HybridMarginGap) instead
	// of the BM25 thresholds above. nil (or no vectors) ⇒ BM25 recall, unchanged.
	Hybrid          catalog.HybridSearcher
	HybridMinScore  float64 // cosine floor for the top hit (hybrid mode)
	HybridMarginGap float64 // cosine margin over the runner-up (hybrid mode)

	Outcome      OutcomeStats // optional; nil ⇒ no outcome decay
	OutcomePrior float64      // k — Beta prior strength for decay (e.g. 2.0)
	OutcomeFloor float64      // reject the recall when the outcome factor drops below this (e.g. 0.5)

	Metrics *telemetry.Metrics // optional; nil-safe — instruments are no-op when provider is unset
	Log     *slog.Logger       // optional; nil-safe — log line omitted when unset
}

type Reinvestigator struct {
	Forge providers.ReinvestForge
	// Run executes a fresh investigation for the request and returns its findings.
	Run func(ctx context.Context, req Request) (providers.Investigation, error)
	Log *slog.Logger
}

type Request struct {
	Source       Source
	Title        string
	Workload     providers.Workload // optional; zero for alerts without a workload
	Reason       string
	Severity     string // alert severity (alert-like sources); shapes prompt + notification
	Environment  string // deployment environment (prod/staging/…)
	Message      string
	Labels       map[string]string
	Annotations  map[string]string // alert annotations (runbook_url, dashboards, …); surfaced in the seed prompt
	GroupKey     string            // Alertmanager group identity (shared by all alerts in one webhook POST)
	At           time.Time
	Fingerprint  string   // Alertmanager fingerprint (stable firing↔resolved); for outcome attribution
	Fingerprints []string // coalesced batch fingerprints; one open is recorded per entry so every constituent alert's resolve matches
	TriggerKey   string   // deterministic incident identity (alert fingerprint, or failing resource+condition) set at trigger time; threaded to Investigation.TriggerKey for stable dedup across reworded re-investigations (#137)
}

type Source string

type StillFailing func(ctx context.Context, w providers.Workload) (bool, error)

type Tool interface {
	Name() string
	Description() string
	Schema() string // JSON Schema for the arguments
	Call(ctx context.Context, args string) (string, error)
}

type WhatChangedTool struct {
	GitOps providers.GitOpsProvider
}