​

Incident Management

​

Personas in the loop

​

End-to-end flow

​

1. Customer agent files

​

2. Sage classifies

• info — usage question, doc lookup, how-do-I. Sage answers directly. See Customer Service Agent for the full helper-mode walkthrough.
• incident — something broke, regression, defect. Hand off to Clara.
• enhancement — feature request. prism_todo + signal lane owner. Not Clara.
• recommendation — process/architecture suggestion. prism_todo + signal lane owner. Not Clara.

​

3. Clara triages (5-tier checklist, SPEC-114)

• Tier 1 — Init reads: env, install_type, project metadata, agent roster.
• Tier 2 — Conditional reads: stack trace, recent journal entries, git rev.
• Tier 3 — Privacy gates: PII scan, sensitive-field detection, secret scrub.
• Tier 4 — Classification: severity P0–P3, scope, kind.
• Tier 5 — Output discipline: structured triage in local postmortem + phone-home eligibility decision.

​

4. Scope decision branches

• customer-internal — local postmortem only; phone-home is rejected at the Pydantic layer (SPEC-115 invariant). Clara signals the customer agent with resolution path.
• prism-product — phone-home eligible.
• mixed — phone-home eligible; carve out the customer side in the body.

​

5. Clara stages the phone-home (not yet sent)

​

6. Operator review gate (cannot be bypassed)

[Clara via Donna] Phone-home pending operator review: <severity> <scope> <kind>.
Preview: ...
Approve / reject / edit?

​

7. Clara calls prism_phone_home

​

8. Clara reports back to the customer agent

​

Failure modes

​

v0.1 known gaps

• No pull-back from GitHub. The customer agent gets one outbound notification when filed, then silence until the operator or Clara manually nudges. A future gh_issue_sync scheduled job is the planned closure — periodic poll of FrankTewksbury/Prism issues, diff against last known state, surface comments and state-changes back to Clara, who surfaces to the original customer agent.
• No operator-review timeout. Pending rows sit indefinitely if the operator does not respond.
• No Sage → Clara SLA. If Sage is overloaded, the customer agent waits silently.
• No “incident status” verb for the customer agent. No way to ask “what is happening with my incident #X” without re-signaling Sage.
• Operator approval is chat-only. SPEC-115 schema supports review_surface=dashboard|cli, but no backing surface exists yet.

​

What stays local vs what phones home

​

Privacy and consent

• Every phone-home goes through redaction: PII scan, sensitive-field scrub.
• retained_sensitive_fields requires explicit operator acknowledgement (ack-retained-sensitive in operator_review.notes).
• The FrankTewksbury/Prism repo is private and invite-only. Notification surfaced to the customer at install time: this is private and invite-only, may be made public in the future.
• The operator-review gate ensures no customer data leaves the Prism deployment without operator stamp.

​

Bridge Agents

​

What “bridge” means

• project (default) — the existing behavior. Same-project addressing only; cross-project sends fail closed. Every persona on every project is project unless explicitly elevated.
• bridge — exempt from SPEC-056 project isolation in both directions, for a narrow backend-enforced allowlist.

​

Routing behavior

• Customer agent → bridge. A customer agent in any project can address Sage or Clara directly: prism_signal(..., to_identity='Sage' | 'Clara'). The backend resolves same-project personas first (preserving local-name precedence) and falls through to the bridge allowlist only if no same-project match exists.
• Bridge → customer agent. Sage or Clara replies using in_reply_to; the backend recovers the originating PID and identity from the parent signal. A bridge send without in_reply_to must include explicit target PID and target identity, otherwise the send is rejected as ambiguous.
• No cross-project broadcasts. Bridge routing supports direct identity-targeted signals only.
• Same-tenant only. v0.1 bridge routing is constrained to a single tenant; cross-tenant bridge is a non-goal that requires a later spec with consent and auth model.

​

Artifact ownership

• Sage / Clara journals, todos, postmortems, and decisions live in PID-PGR01.
• Bridge agents do not write directly into customer project artifact stores in v0.1.
• A customer agent may decide to persist a local todo / journal in their own PID after receiving a bridge reply — receiver-owned, not bridge-owned.

​

Audit

• From PID-PGR01: all bridge traffic handled by Sage / Clara.
• From a customer project: only that project’s own bridge traffic — never unrelated PID-PGR01 internals.

​

Roster visibility

{
  "identity": "Sage",
  "persona_class": "bridge",
  "home_pid": "PID-PGR01",
  "available_from_pid": "PID-DPA01"
}

​

Admin contract — v0.1 limitations

• No customer opt-out in v0.1. Universal bridge availability is accepted for v0.1. A customer-side opt-out is a non-goal until a later spec revisits it.
• The operator-stamped admin verb is deferred to v0.2. v0.1 ships with seed-time bridge assignment only: Sage and Clara are seeded as bridge personas through the operator-authorized install path, and the only way to demote them is via the same seed migration.
• Bootstrap cannot self-elevate. Bridge status derives from stable identity / admin state — not bootstrap payloads, session registrations, prompt text, or local config. A persona declared bridge in a prompt or .agent/personas/*.json file is not actually a bridge until the operator-stamped seed runs.

​

References

• SPEC-114 v0.1 — Sage and Clara persona contracts.
• SPEC-115 v0.1 — prism_phone_home verb, ET service, gh CLI transport.
• SPEC-116 v0.1 — Bridge Agents: persona_class='bridge' cross-project routing primitive.
• ADR #58 — intel/% recall opt-in split (related governance).
• ADR #59 — Bridge Agents: cross-project routing primitive for Customer Care.
• Postmortem 4f21262d — Plan #19 v0.1 cross-project unreachability incident (motivated SPEC-116).
• Plan #19 — Customer Care system delivery plan.
• Pilot Onboarding — operator-facing pre-install + opt-out + dry-run guide.

​

Related