States, badges and health codes

The exact values behind a filter’s status line, its health verdict, the deployment’s warnings and the alerts Sift sends. For what they mean in practice, see Health, Actions and alerts and Filters and their lifecycle.

Lifecycle states

State	Scores events	Filters	Meaning
draft	no	no	Created, with no spec to run yet.
authoring	no	no	A spec is being written and reviewed.
shadow	yes	no	Scoring every event and escalating every one of them.
proposed	yes	no	An operating point has been computed and is waiting on a person’s decision.
active	yes	yes	Filtering events that score below the approved threshold. The only state that filters.
paused	no	no	Holding events: Sift is not reading the source, so nothing is scored, filtered or sent to the agent.
retired	no	no	End of life. There is no move out of it.

Moves between states

From	To	Approval needed	Also requires
draft	authoring	none	a spec
authoring	shadow	gold-set approval	a spec; a paired agent if the filter sends whole events
authoring	draft	none
shadow	proposed	none	a trained model in shadow; a paired agent if the filter sends whole events
shadow	active	none (a resume)	a standing threshold approval for the current version; a paired agent if the filter sends whole events
shadow	paused	none
proposed	active	threshold approval	a spec; a paired agent if the filter sends whole events
proposed	shadow	none
proposed	paused	none
active	paused	none
active	shadow	none
paused	shadow	none
paused	active	none (a resume)	a standing threshold approval for the current version; a paired agent if the filter sends whole events
any but retired	retired	none

Every move that reduces filtering needs no approval. The console names active to shadow Stop filtering and a move to paused Hold events. A move back into active from shadow or paused is a Resume, which re-affirms the standing approval with a written reason. Sift can also move an active filter to shadow itself: a fall-back.

Status badges

The Filters page, the filter’s header and the threshold screen show at most two badges: first whether the filter is filtering, then whether anything is wrong.

Badge	Shown when
Filtering	The filter is active and can filter at its operating point.
no first badge	The filter is active and filters nothing. It always has a health verdict then (active.filters_nothing).
shadow, proposed, paused, draft, authoring, retired	The filter is in that state, and so is not filtering. The badge shows the state’s name (rendered in capitals, such as SHADOW); its hover text reads, for example, “Shadow: not filtering”.
Attention	The health verdict is attention. Hover text is the reason; it links to the filter’s Actions tab.
Fault	The health verdict is fault. Hover text is the reason; it links to the filter’s Actions tab.

A healthy filter (ok) has no health badge.

Health codes

Each filter has one health verdict: ok, attention (a person should look) or fault (something is broken). A verdict that is not ok carries a code, a reason and the act that resolves it. The code is stable while the condition holds; the reason’s numbers change. Each code has one severity. Alerts and webhooks are keyed by the code.

On the dashboard, Alerts, the fleet table and the Filters list, a filter’s health can lag by a moment: a change to a filter itself shows at once, a new label or agent run can take a little longer. A filter’s own page, alerts and webhooks, and every approval show the current state.

Faults

Code	Meaning	What to do (console action)
delivery.failing	Escalations are not reaching the agent. On an active filter, it goes on filtering everything else; otherwise the verdicts it learns from are not arriving.	Check delivery: Settings › Delivery. Check the Kindo connection and the agent.
polling.failing	The source has failed to poll 3 or more times in a row, so nothing new is scored.	Check the source.
alarm.keep_filtering.drift	A drift alarm is open and the filter keeps filtering through it, because On alarm is Keep filtering.	Investigate.
alarm.keep_filtering.ceiling	The filter passed its trigger ceiling and keeps filtering through the alarm.	Investigate.
deliver.verdict_shift	With Shape delivery grouping, the agent finds grouped events actionable less often than events sent singly: grouping is hiding events it would act on. Under Stop filtering, the stage returns to measuring.	Group less, or switch it back to measuring (Settings › Pipeline).
deliver.overdue	Held groups are past their due time and nothing released them. They count as undelivered, and Sift later sends them singly.	Check delivery. See deliveries_overdue below.
guarantee.paused	Always-escalate rules have had no answer from the decision model for 15 minutes or more, on an active filter. The filter runs as approved, without the escalations the rules would add.	Check the decision model. Clears on the next answered batch.
queue.losing	The agent budget’s held queue lost escalations in the last hour: aged out past its age limit, or pushed out of a full queue. The agent never saw them. Clears an hour after the last loss.	Raise the budget or the queue: Settings › Delivery. Or accept the loss.
loosened.drift	Sift moved the filter to its safer point on a drift alarm (On alarm is Filter at a safer point). It keeps filtering, at the looser point its approval named, so more reaches the agent. A second drift breach falls it back to shadow.	Return to the approved point, or the alarm’s other moves (Investigate, Retrain).

Attention

Code	Meaning	What to do (console action)
alarm.acknowledged	The filter was resumed over an open drift alarm. It keeps filtering until the reading clears, seven days pass, or another signal breaches.	Review the alarm.
fell_back.drift	Sift stopped the filter filtering on a drift alarm and withdrew its approval. It escalates everything.	Resume or retrain.
fell_back.ceiling	Sift stopped the filter filtering when it passed its trigger ceiling, and withdrew its approval.	Resume or retrain.
fell_back.unapproved	Sift stopped the filter filtering because its current version has no approved operating point.	Approve the running model or retrain, Approve on its evidence, or Retrain it.
approval.needed	A new version changed what the filter filters, so it escalates everything until the running model is approved at it or it is retrained.	Approve the running model or retrain.
version.pending	A version that needs approval waits behind the running one, which keeps running as it is until then.	Review the change.
retrain.waiting	A retrained model, or a stage ready to join, is waiting. The running model keeps filtering until somebody decides.	Review the retrained model.
model.stale	The active model has gone more than twice its retrain schedule without a retrain (a never schedule ages as weekly).	Retrain it.
active.filters_nothing	Active, but filtering nothing: every stage that filters is in shadow, or no operating point is in force.	Depends on the cause: Switch it back on in Settings, Review the retrained model, Review the proposed operating point, Train a model to propose one, or Review the operating point.
events.held	The filter is paused. Its agent receives nothing from Sift until it scores again.	Resume on the current model, or Move it back to shadow.
spec.missing	The filter has no spec, so there is nothing to run.	Write its spec.
gold_set.waiting	A gold set is waiting for review; nothing can train until it is approved.	Review the gold set.
agent.unconfigured	The paired agent says it has no instructions, so escalations go unjudged and its runs are left out of training.	Configure its agent.
agent.no_verdict	The agent’s newest runs all returned no verdict Sift could read, so the filter has stopped learning.	Check its agent (the paired agent), or Read the briefing (an agent Sift did not write).
agent.outdated	The paired agent was generated to a contract version Sift no longer supports, so it may act twice on an event sent twice.	Regenerate the agent and pair the new one.
displaced_agent.running	The agent this filter replaced has run again, so both run on this traffic.	Retire it in Kindo.
displaced_agent.unverified	Sift cannot confirm that the replaced agent has stopped, so no spend saved is reported.	Check it in Kindo, or acknowledge it on Actions.
verdict_check.open	Enough agent verdicts the decision model disputes are waiting for a person.	Check the verdicts.
decision_fit.dropped	The decision model reads this filter less well than a feature it uses needs. Nothing is switched off.	The feature’s own act.
guarantee.rule_review	A plain-language rule sends fewer actionable events than a looser Decide threshold would for as many extra escalations.	Review rule ”…” in Settings › Pipeline.
collapse.runaway	One group holds more than Runaway share of the last day’s events: almost certainly distinct events merged.	Retune or switch it to shadow.
collapse.compression_shift	The share of events Collapse folds away moved by at least Compression shift against the week before.	Retune or switch it to shadow.
deliver.at_char_cap	Group runs were sent full at the character cap in the last days, so their events were cut to fit.	Fewer events per run, or a higher cap.
budget.bound	The agent budget is spent: it kept escalations back in the last hour, and they wait in the held queue (or as grouped runs) for room. The agent sees them late.	Open the agent load: Settings › Delivery.
queue.filling	The held queue is at the budget’s Warn at share of its depth limit, or its oldest item of its age limit. Past either limit, escalations leave it unsent.	Open the agent load.
budget.record_only	Under Record only, escalations over the budget were recorded and not sent in the last hour.	Open the agent load.
budget.near	Agent runs reached the budget’s Warn at share in 2 of the last 3 hours. Alerted only when it is the filter’s verdict.	Open the agent load.
load.unbounded	No agent budget, and the agent runs the filter started were over its agent’s capacity in each of the last 2 hours. Only the deployment’s Kindo rate limit bounds them. Raised in shadow and proposed only, including on a filter with no agent-load settings of its own (it is then measured against the deployment’s default capacity). Runs a warm start sends count.	Set a budget: Settings › Delivery.

The agent-load attention codes (budget.bound, queue.filling, budget.record_only, budget.near, load.unbounded) are not shown on a paused filter: events.held ends its list. A paused filter keeps its held queue, and neither sends nor ages it out until it resumes.

Setup codes

While a filter is being set up, its verdict is its current Setup step: setup.<step>.action when a person can do the step now, and setup.<step>.problem when the step stopped (a build failed, a set was rejected, a training run failed). Both are attention. A step Sift is doing, or one that cannot start yet, reads ok.

<step>	Step title on the Actions tab
spec	Write its spec
pair_agent	Connect its agent; or Regenerate the agent, Fill in its agent’s instructions, Get its agent’s verdicts back
gold_set	Review the gold set
start_shadow	Start watching in shadow
collect_labels	Collect n labels; Collect 20 actionable events; or Collect verdicts on ranked hours
resume	Resume on the current model
train	Train a model
approve_threshold	Approve an operating point
measure_stage	Measure collapsing; Measure what grouping saves
collect_stage_verdicts	Collect n cluster verdicts
approve_stage	Approve collapsing repeats; Switch grouping on
stage_agent	Pair an agent that takes groups

System warnings

GET /api/v1/system/status lists the deployment’s warnings. Each has a code, a severity (critical, warning or info), a message and a remedy. The Alerts page lists critical ones under Faults and the rest under Waiting on you.

Code	Severity	Meaning	What to do
default_admin_password	critical	The seeded admin account still uses the default password.	Change the password from the account menu, or set SIFT_DEFAULT_ADMIN_PASSWORD before first start.
no_kindo_credential	warning	No Kindo API key is stored, so nothing can reach Kindo.	Add one under Administration. See The Kindo connection.
kindo_credential_unverified	warning	The stored key has not been verified against the API.	Run Verify on the credential.
kindo_model_unselected	warning	No model is chosen on the Kindo connection, so Sift uses SIFT_COPILOT_MODEL.	Choose one on the Kindo connection page.
kindo_model_unavailable	critical	The latest Verify found the chosen model is no longer offered to the key; every call Sift makes names it.	Choose another model on the Kindo connection page.
escalations_undelivered	critical	Filters decided to escalate events that never reached an agent. Filtering has stopped while this holds, but events already filtered were not seen.	Check that Kindo is reachable and the key is valid, then review the filter’s Filtered events for the window. Once delivery works, escalations from the last 24 hours on running filters are sent again within about 20 minutes.
escalations_failing	warning	The agent is refusing escalations. Filtering has not stopped yet.	Check that Kindo is reachable. If it stays down, filtering stops and this becomes escalations_undelivered.
scoring_backlog	critical	Events read more than 30 minutes ago have never been scored, so they are neither filtered nor escalated.	Sift’s background services are not keeping up. An operator checks them: see Troubleshooting.
polls_overdue	critical	Running filters have not been polled for more than 15 minutes past when they were due.	Sift’s background services are not keeping up. An operator checks them: see Troubleshooting.
deliveries_overdue	critical	Delivery groups are more than 2 minutes past their due time and nothing released them.	Sift’s background services are not keeping up. An operator checks them: see Troubleshooting.
cutover_incomplete	warning	Active filters replaced an agent that has run again, so both agents run and no spend saved is reported.	Retire or repoint the old agent in Kindo, or acknowledge it on the filter’s Actions.
cutover_unverified	warning	Sift could not read the agent a filter replaced, so whether it still runs is unknown.	Check the Kindo key and that the agent exists, or acknowledge it on the filter’s Actions.
agent_runs_backlogged	warning	An agent run waited more than 5 minutes on the deployment’s Kindo rate limit in the last 15 minutes. Every filter, the reading of agent verdicts, and the assistant share that limit, and no filter’s agent budget sees it.	Set an agent budget on the busiest filters, so their overflow waits in their own queue in priority order. Raise SIFT_KINDO_MAX_REQUESTS_PER_SECOND only if the Kindo tenant’s quota allows.
webhook_failing	warning	Webhook endpoints are not receiving alerts: a delivery has retried for more than 15 minutes, or one was abandoned in the last day.	Open the gear icon (Administration) › Notifications to see what the receiver answered. A delivery that could not be decrypted means SIFT_SECRET_KEY changed: enter the endpoint’s URL and secrets again.
broker_unreachable	critical	One of Sift’s background services did not answer: nothing is polled, scored, triggered or sent.	An operator checks the services: see Troubleshooting.
worker_pool_silent	critical	One or more of Sift’s background services has stopped reporting in. This is raised within 15 seconds of one stopping.	An operator checks the services: see Troubleshooting.
decision_model_unavailable	warning	The decision model is not answering, and filters use it. Their decision-model features pause; each runs as it would without them.	Check the decision model under the gear icon (Administration) › Decision model.
decision_model_direct	info	Sift calls the decision model directly, outside Kindo.	None needed. Unset SIFT_JEV_ENABLED to stop.

Alerts

Sift turns every filter health verdict that is not ok, every system warning, and a failing or degraded Kindo connection into an alert. An alert is raised once its condition has held for 2 minutes and cleared once it has been gone for 10 minutes. Webhooks receive the raise and the clear. See Notifications and webhooks.

Category	Console label	Contains
filter_fault	Filter faults	Filter health codes with severity fault.
filter_attention	Filters waiting on someone	Filter health codes with severity attention.
system	Deployment	System warnings, and the Kindo connection as kindo.failing (fault) or kindo.degraded (attention).

A filter’s alert is its verdict: its first condition. The agent load’s conditions are the exception. budget.bound, queue.filling, queue.losing, budget.record_only, loosened.drift and load.unbounded are each an alert of their own, keyed by their own code, even when another condition leads the verdict, and each is raised and cleared on its own. budget.near is alerted only as the verdict, so a filter that often runs near its budget pages nobody.

A new webhook endpoint subscribes to filter_fault and system by default. No webhook carries escalations_undelivered, escalations_failing, cutover_incomplete, cutover_unverified or deliveries_overdue (each filter’s own alert carries them), broker_unreachable or worker_pool_silent (alerts cannot be sent while those hold), or decision_model_direct (a configuration, not a fault). A retired filter raises nothing.