The pipeline: slots and stages

Every event a filter reads passes through the same four positions, in the same order. Each position asks one question about the event. This page explains what the four are, which of them can filter an event, how they combine, and which changes to them need a person’s approval.

Four slots, one question each

A slot is a position in the pipeline. The stage in a slot is the recipe a filter puts there, with its settings. A filter has at most one stage per slot, and leaves out the slots it does not need. It must have at least one stage that can filter (Collapse repeats or Decide); a filter with neither could never filter anything.

Order	Slot	The question it answers	Can it filter?
1	Always escalate	Must this event reach the agent whatever the later stages decide?	No. It only adds escalations.
2	Collapse repeats	Is this event a near-copy of one already sent?	Yes. The repeats are filtered.
3	Decide	Is this event worth the agent’s run?	Yes. Events scoring below the threshold are filtered.
4	Shape delivery	How should the escalations reach the agent: one per run, or grouped?	No. It groups escalations into fewer runs.

Always escalate and Shape delivery never filter, by design. Always escalate exists so you can state rules that override Decide (“anything from this host always goes”). Shape delivery acts after the decision, on what is already escalating: it changes how many runs carry the escalations, not which events reach the agent.

Stage modes

A stage runs in one of two modes. In shadow it is measured: Sift runs it on every event and records what it would have done, and its decision is ignored. In active it takes part in the decision. Each slot names its modes in its own words, because “filtering” would be wrong for a slot that never filters.

Slot	Shadow mode	Active mode
Always escalate	Watching: records what its rules would send, sends nothing extra	Escalating
Collapse repeats	Measuring	Filtering
Decide	Measuring	Filtering
Shape delivery	Measuring: every escalation goes in its own run, and Sift replays what grouping would have saved	Grouping

A stage’s mode and the filter’s state are separate. An active stage filters only on a filter in the active lifecycle state. On a filter in shadow or proposed, every event goes to the agent whatever the stages decide, and the console shows a Collapse repeats or Decide stage as measuring. See Shadow and filtering.

You set Always escalate, Collapse repeats and Shape delivery’s mode in Settings › Pipeline. Decide has no mode control: it starts deciding through an approved threshold, never through a setting. See Operating point and approval.

How one event is decided

Sift applies the active stages in pipeline order, then the leak-through sample:

Always escalate, field rules. If a field rule matches, the event escalates, and nothing later can filter it.
Collapse repeats. If the event repeats an event already seen within the window, it is filtered, and the group goes to the agent once.
Decide. If the event passes the deciding recipe’s operating point (a score at or above the threshold, a place in the hour’s budget, or a matching rule), it escalates; otherwise it is filtered. With no Decide stage, an event that survives Collapse escalates.
Leak-through. A small random share of filtered events (3% by default) is sent anyway. The agent cannot tell them apart from any other escalation.
Always escalate, plain-language rules. Once Decide or Collapse has filtered an event, a decision model is asked each plain-language rule about it. An event it says yes to is sent on. These rules only run if a decision model is configured.
Shape delivery. The escalations are sent, one per run or grouped into runs of up to 50 events.

Each event ends with one of four outcomes:

Outcome	What happened	Counts as
Escalated	Sent to the agent.	Escalated
Filtered by Decide	Decide scored it below the threshold.	Filtered
Absorbed	Collapse folded it into an earlier event.	Filtered
Leak-through	A stage filtered it, the sample drew it, and Sift sent it anyway.	Escalated

Filtered always means filtered by Decide plus absorbed: events the agent never received. Each one is listed under Filtered events, with its score and model version but not its content. A leak-through event is never counted as filtered or as a run avoided. On a filter that is not active, Sift records what each event would have been and sends everything; the console calls that would filter.

The deciding stage

One stage carries the filter’s model, operating point and threshold approval: the deciding stage. It is Decide when the filter has a Decide stage. A filter with only Collapse repeats is decided by Collapse, and is approved on Collapse’s own evidence (how much it folds and whether the agent judges a group’s events alike) rather than on a trained model. The Overview tab names the deciding recipe under How it decides.

Changes that need approval

A stage change is either free (saved at once) or gated (it needs a person’s approval before it takes effect on a filter that is filtering). The rule is one direction:

A change that could filter more, or escalate less, is gated.
A change that can only filter less, or escalate more, is free.

Slot	Free	Gated
Always escalate	Adding the stage; switching it to escalating; adding a rule; widening a rule’s reach; raising the hourly cap	Removing it; switching it to watching; removing a rule; narrowing a reach; editing a question or a field rule; lowering the cap
Collapse repeats	Removing it; setting it to measuring; any change while it is measuring	Switching it to filtering; any change to its settings while filtering, tighter or looser
Decide	Any change while it is measuring on both sides	Starting to decide; changing its recipe, settings or removing it while it decides
Shape delivery	Any change while measuring; switching back to measuring; grouping less	Switching to grouping; grouping more (a longer wait, larger runs); a change with no clear direction

Changing which recipes are compared beside a stage (its candidates) is always free.

Settings › Pipeline shows each block’s consequence before you save, with one of the badges No change, Free, Needs approval, Waits for approval or Cannot change. A gated change to a stage on an active filter usually becomes a waiting version: the filter keeps filtering on its running version until the new one is approved. A change that replaces the deciding recipe or its settings has no measurement behind it, so saving it returns the filter to shadow. (A filter that filters through Collapse repeats alone is the exception: retuning Collapse’s similarity, window or group size waits, measured on Collapse’s own evidence.) Starting to group, or grouping more, in Shape delivery waits in every state, not only on an active filter.

Where you see the pipeline

Overview › How it decides. One section per stage, with the slot’s title, the recipe, and a badge in the slot’s mode words (filtering, measuring, grouping, watching, escalating).
Settings › Pipeline. “One block per slot, in the order an event meets them”, each with its editor and change badge.
New filter, review step. A strip reading Reads, each slot in order (an unused one shown as off), then Sends to.
Activity. The filter’s timeline, with a Rescues chip for the events Always escalate sent on, and a link to Filtered events.

Recipes: what can stand in each slot.
Use Collapse, Always escalate and Shape delivery
Change a filter’s settings
Filter settings reference