Anomaly Detection

Deterministic stats gate the model: cheap, reproducible statistics detect anomalies; the LLM is invoked only to explain them. Pure LLM anomaly hunting over raw rows is wasteful and non-reproducible, the stats pass keeps it auditable and near-zero cost on the clean path.

Stats pass (no LLM)

Queries executions for the last N runs (default 200) and detects:

• Duration spike, z-score > 2.5 against per-script mean; warning, or error when z > 4.
• Status flip, first failure after a run of successes; error.
• Rows-affected drift, current run > 5x or < 0.2x the per-script mean; warning.

LLM pass (synthesis)

When anomalies exist, the model receives the list and returns a 1-2 sentence oncall-readable summary. No anomalies → no LLM call (zero cost).

Inputs

• Lookback count (optional, default 200), recent executions to analyze
• Script ID (optional), scope to one script's runs

Output

{
  anomalies: [
    {
      executionId, scriptName, type, severity, detail, metric
    }
  ],
  summary: 'plain-English synthesis of detected anomalies'
}

Scheduled use

Drive on an interval: POST /api/ai/agents/anomaly-detection, alert when anomalies.length > 0 at severity error.