Storm Link

When one interface fails, every component downstream raises its own alert. Storm Link turns that storm into one answer: the root cause, written to the Managed Alert that on-call already watches.

How it works:

• Groups by topology: a versioned graph of the Production joins alerts that share an upstream path and picks the upstream root.
Asks only when needed: a detector spots root conflicts and possible coincidences, and an IRIS AI Hub agent (%AI.Agent, local Llama 3.2 3B) answers one yes/no question per conflict.
Every answer is checked: a code gate validates each model answer against the candidate roots and the exact partition.
Writes where on-call looks: all original alerts become Ens.Alerting.ManagedAlert records; the root alert carries the AI reason as an action reason, saved in the same transaction as the receipt.
Traceable: each storm is one Visual Trace session, Service to Process to Agent and back, showing model, tool calls and duration.
Idempotent: resubmitting a storm returns the saved receipt with no new alerts and no new agent calls.

Results:

Ambiguous storms solved exactly: 5/18 with the graph rule, 14/18 with graph + AI.
Development set: 14/14 solved exactly.
• 12 native IRIS test methods, 72 assertions, all passing.

Runs with docker compose up on the InterSystems IRIS AI Hub Community image. Replay mode needs no API key or model download; live mode uses a local Ollama model.

Tested on: InterSystems IRIS 2026.3 AI Hub Community, build 154