Incident response evidence collection with Jev
Prometheus rules and PagerDuty already page on numeric thresholds. Jev is optional on messy customer-reported incidents or multi-alert narratives: which SEV band, which runbook class? It does not roll back deploys or page people.
This unofficial page is the evidence collection slice of the incident response classification pack. Intent: apply the Jev (TypeSafe System One) decision model to incident response classification evidence collection. Primary search language: Incident response Jev evidence collection. Confirm patterns on docs.typesafe.ai. This site does not sell, issue, or proxy TypeSafe keys. Use a credential you already have from the console or a documented gateway.
Independent angle (cover ≠ clone): Runbooks and pagers stay; Jev classifies messy alert/customer text into SEV / runbook class, then code pages. Not a runbook-clone or status-page IA photocopy. Fan-out extra atoms on one request; open a second HTTP call only for a new artifact, not the same state.
Incident response use-case context
Evidence collection for incident response classification happens before POST /v1/systemone. Jev does not browse your warehouse, retriever, or ESP. You gather the alert/customer incident narrative facts, filter them, then ask snap questions. This slice is where fan-out cost math belongs: batch questions, do not re-send state.
Hub: Use cases. Compare, when the other tool is the real job: incident runbooks.
Evidence Collection inputs
Collect:
- The customer or alert text that is messy
- A few coarse signal buckets you computed (not raw series)
- The SEV definition excerpt
Never send:
- Asking Jev to compute error rates
- Paging from Jev directly (your code calls the pager)
- Full heap dumps
Shape the payload like this once the gather step finishes:
{
"report": { "id": "INC-44", "text": "Checkout 500s since 14:02 UTC after the payments deploy. Status page still green." },
"signals": { "error_rate_bucket": "high", "payments_deploy_recent": true },
"policy": { "sev1": "SEV1 = complete checkout loss or safety." }
}Decision signals and actions
Each evidence field should change a named answer:
| Id | Type | Job |
|---|---|---|
sev |
Choice | sev1 / sev2 / sev3 / other |
runbook |
Choice | payments_deploy / dependency / capacity / unknown / other |
customer_impact |
Noul | Does the narrative describe user-visible loss vs policy.sev1? |
SEV + runbook + customer_impact in one call. Hierarchical product trees (if you have them) are a second Choice cascade with confidence abort — do not stuff 200 services into one Choice.
Do not treat a Noul of 0.5 as a “medium” incident response classification score — it means yes and no are equally likely. Conjunctions stay in your code.
Guardrails and escalation
If the gather step fails (empty alert/customer incident narrative, redaction stripped everything, retriever empty), fail closed on paging SEV1 / rolling back via automation. Do not invent evidence so Jev has something to say. TypeSafe’s confidence-gated examples use a lower bar for recoverable reads than for irreversible actions. Those numbers are illustrations. For incident response classification, treat page_sev1 as the high bar (paging SEV1 / rolling back via automation). Tune on labels — see offline evaluation.
Evaluation and rollout notes
Your eval set should include thin-evidence cases, not only happy alert/customer incident narratives. Label SEV gold from ICs, runbook-class gold, and whether a page was warranted. Pin jev-1.13.0 (the versioned id) after you fit thresholds. jev-latest and the marketing line jev-1.13 can move. Log the response model. TypeSafe’s published list price for jev-1.13 is $0.042 per million input tokens (vendor claim — confirm on the models page); output tokens are free on that same page. Unused distractors still bill as input.
Official Python and JavaScript SDKs read TYPESAFE_API_KEY and retry documented 429/529. This site does not sell, issue, or proxy TypeSafe keys. Use a credential you already have from the console or a documented gateway.
Pack map
| Slice | Page |
|---|---|
| Graph and primitives | decision workflow |
What may enter state |
input contracts |
| What to gather first | you are here |
| Atomic rules | policy checks |
| Act / review / abstain | confidence thresholds |
| Reviewer payload | human handoff |
| What to persist | audit trail |
| How it breaks | failure modes |
| Labeled replay | evaluation |
| Shadow → canary | production rollout |
FAQ
Should evidence live in the question text?
Put facts in state and point instructions at report.text, policy.sev1, signals.error_rate_bucket. Criteria stay stable so you can replay.
When do I split calls? SEV + runbook + customer_impact in one call. Hierarchical product trees (if you have them) are a second Choice cascade with confidence abort — do not stuff 200 services into one Choice.
Where is the rest of the Incident response pack? Start with Incident response input contracts and Incident response decision workflow. Cluster hub: Use cases.
If metrics already say critical, should we wait for Jev? No. Metrics page now. Jev is for leftover messy text. See safe defaults.
Can Jev write the status-page update? Not in this workflow. Classification only. Generation is a different job.
What this page does not claim
- Not a pager, status page, or IR retainer.
- No MTTR or uptime claims.
- Not official TypeSafe.
- Official TypeSafe status, or that jev.pro issues API keys.
- That a schema-constrained answer is automatically factually correct.
Disclaimer
This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai.
Primary documentation: https://docs.typesafe.ai. Hub: Use cases.
Sources
Public TypeSafe or adjacent documentation only. No private claims.