------Z --- --
102105012

Indications and Warning Tripwire Watch

Stands watch on the indicator list from the running estimate and flags reporting that touches an indicator that has not yet been observed. Pushes to a human, never acts alone.

PrewiredIndications and Warning Agentv0.1.0trigger: schedulewf.s2.iw-tripwire
Doctrine

The exact use the IC names as generative AI best fit: standing watch and war gaming support, with the analyst owning the judgment. Assessment sections 4.1 and 6.

Human gate: Alerts push to a human. The agent never changes an indicator state or the assessment.

Trigger: On every reporting batch once wired (today: run manually).

Tripwire alerts with citing reports
The pipeline (5 steps, Arazzo shaped)
  1. 01Read the indicator listRETRIEVEgetRunningEstimateAssessment

    Indicators and warnings with their observed state, PIR, and NAI.

    Success criteria
    • Indicator list read
    Outputs
    indicators
  2. 02Read recent reportingRETRIEVElistReporting

    The reporting stream the tripwires are checked against.

    Success criteria
    • Reporting read
    Outputs
    reports
  3. 03Check tripwiresREASONmatchIndicatorsToReporting

    Match unobserved and partial indicators against report summaries; every alert cites the report that tripped it.

    Success criteria
    • Every alert cites a report
    • No indicator state changed by the agent
    Outputs
    alerts
  4. 04Analyst reviews alertsHUMAN GATES2 analystapprover: S2 analyst

    The analyst decides whether an indicator state actually changed. The agent never updates the estimate itself.

    Success criteria
    • Human review recorded
    Outputs
    review
  5. 05Raise the alertNOTIFY (simulated)addTipCueMessage

    Push reviewed alerts to the net and the running estimate owner.

    Success criteria
    • Alert drafted
    Outputs
    notification
Dry run console
Reads are live. Writes are simulated. Nothing changes until a human gate clears.
Agentic binding (the wire, when approved)
s2-fusion-intel-apiiwTripwireWatch

Wired mode runs per reporting batch and pushes alerts; dry run lists what would alert.

Prerequisites live in src/lib/agentic/client.remote.ts.template: published OpenAPI description, accepted Arazzo documents, a scoped server side credential, and an approved agent runtime. Until then, the selector stays on the local dry run engine.

Foundry / MSS twin (after migration)
Automate trigger on INTEL_Evidence writes + notification

Indicator records become first class objects the trigger watches.