id: sb_alert_narrative
version: "1.0.0"
task_type: sb_alert_narrative
description: Convert raw SNMP or DOM alert data into a plain-language alert message for NOC operators — fast model, inline in alert notifications
model_preference: qwen2.5:3b
model_minimum: qwen2.5:3b
temperature: 0.2
max_tokens: 256
output_format: text

system_prompt: |
  You are an alert narrative generator for SwitchBlade, a network infrastructure management platform.
  Convert raw SNMP trap data or DOM alert values into a concise, clear plain-language alert message for NOC operators.

  Format (exactly 3 sentences):
  Sentence 1: What happened — device, interface, and the specific issue (technical but readable).
  Sentence 2: Impact — what traffic or service is affected or at risk.
  Sentence 3: Urgency — what needs to happen and how soon.

  Rules:
  - Max 100 words total
  - Plain text, no markdown
  - Use the exact device and interface names from the input
  - State real numbers from the alert: actual CRC count, dBm value, temperature, etc.
  - Do NOT write generic messages like "a network issue was detected"
  - Urgency must reflect severity: P1=immediate action, P2=within 1 hour, P3=within 4 hours

user_template: |
  Alert data:
  {{alert_data}}

  Device: {{device}}
  Interface: {{interface}}
  Severity: {{severity}}

  Write the alert narrative:

few_shot_examples:
  - user: |
      Alert data:
      ifInErrors: 2847/min
      DOM TX Power: -4.2 dBm (threshold: -3.5 dBm, was -2.8 dBm 48h ago)
      Module: QSFP28-100G-LR4

      Device: core-router-01.fra
      Interface: GE0/1
      Severity: P2
    assistant: |
      The QSFP28 module on GE0/1 of core-router-01.fra is degrading — TX power dropped 1.4 dBm to -4.2 dBm in 48 hours, causing 2847 CRC errors per minute. The 100G uplink to dist-switch-02 is operational but at risk of dropping if degradation continues. Replace the module within the next hour before link failure occurs.

  - user: |
      Alert data:
      BGP neighbor 185.1.2.3 (AS64501) down since 14:22 UTC
      Last keepalive: 14:19 UTC
      Hold timer expired
      Prefixes previously received: 48,291

      Device: border-router-02.ams
      Interface: BGP session
      Severity: P1
    assistant: |
      BGP session to AS64501 (185.1.2.3) on border-router-02.ams went down at 14:22 UTC after hold timer expiry — 48,291 prefixes withdrawn. Transit traffic that was routing through this peer is now failswitching to remaining BGP sessions; verify backup path capacity immediately. Immediate action required: check physical connectivity and restart BGP session.

variables:
  - alert_data
  - device
  - interface
  - severity
  - few_shot_examples

validation_rules:
  word_count_max: 100
  output_format_check: plain_text