@merittdev/horus 0.12.3 → 0.12.5

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.12.3" : "dev";
+var HORUS_VERSION = true ? "0.12.5" : "dev";
 var PINNED_SOURCE_VERSION = "2.0.2";
 
 // ../../packages/core/src/evidence.ts
@@ -71622,6 +71622,167 @@ var SourceMemoryVectorIndex = class {
 // ../../packages/connectors/src/contract.ts
 init_cjs_shims();
 
+// ../../packages/connectors/src/duration.ts
+init_cjs_shims();
+function readPath(obj, path) {
+  if (Object.prototype.hasOwnProperty.call(obj, path)) return obj[path];
+  const parts2 = path.split(".");
+  let node = obj;
+  for (const part of parts2) {
+    if (node === null || typeof node !== "object") return void 0;
+    node = node[part];
+  }
+  return node;
+}
+var UNIT_MS = {
+  h: 36e5,
+  m: 6e4,
+  s: 1e3,
+  ms: 1,
+  us: 1e-3,
+  "\xB5s": 1e-3,
+  ns: 1e-6
+};
+var DURATION_TOKEN = /(\d+(?:\.\d+)?)\s*(ms|us|µs|ns|h|m|s)(?![a-zA-Z])/gi;
+function parseDurationMs(raw) {
+  if (typeof raw !== "string") return null;
+  const s5 = raw.trim().replace(/^~/, "");
+  if (s5 === "") return null;
+  let total = 0;
+  let matched = false;
+  DURATION_TOKEN.lastIndex = 0;
+  let m5;
+  while ((m5 = DURATION_TOKEN.exec(s5)) !== null) {
+    const value = Number(m5[1]);
+    const unit = m5[2].toLowerCase();
+    const factor = UNIT_MS[unit];
+    if (Number.isFinite(value) && factor !== void 0) {
+      total += value * factor;
+      matched = true;
+    }
+  }
+  if (matched) return total;
+  if (/^\d+(?:\.\d+)?$/.test(s5)) {
+    const n4 = Number(s5);
+    return Number.isFinite(n4) ? n4 : null;
+  }
+  return null;
+}
+function extractByRegex(text2, regex) {
+  const m5 = regex.exec(text2);
+  if (m5 === null) return null;
+  const captured = m5[1] ?? m5[0];
+  const v4 = captured.trim();
+  return v4 === "" ? null : v4;
+}
+function percentile(sortedAsc, p5) {
+  const n4 = sortedAsc.length;
+  if (n4 === 0) return 0;
+  if (n4 === 1) return sortedAsc[0];
+  const rank = Math.ceil(p5 / 100 * n4);
+  const idx = Math.min(n4 - 1, Math.max(0, rank - 1));
+  return sortedAsc[idx];
+}
+function computeStat(durations) {
+  const finite = durations.filter((d3) => Number.isFinite(d3));
+  if (finite.length === 0) {
+    return { avg: 0, p95: 0, count: 0, min: 0, max: 0 };
+  }
+  const sorted = [...finite].sort((a2, b5) => a2 - b5);
+  const sum = sorted.reduce((acc, d3) => acc + d3, 0);
+  return {
+    avg: sum / sorted.length,
+    p95: percentile(sorted, 95),
+    count: sorted.length,
+    min: sorted[0],
+    max: sorted[sorted.length - 1]
+  };
+}
+function readDimension(rec, spec) {
+  if (spec.field !== void 0) {
+    const raw = readPath(rec.fields, spec.field);
+    if (raw === null || raw === void 0) {
+      if (spec.pattern === void 0) return null;
+    } else {
+      const v4 = String(raw).trim();
+      if (v4 !== "") return v4;
+      if (spec.pattern === void 0) return null;
+    }
+  }
+  if (spec.pattern !== void 0) {
+    const sourceField = spec.patternField;
+    const text2 = sourceField !== void 0 ? typeof readPath(rec.fields, sourceField) === "string" ? readPath(rec.fields, sourceField) : String(readPath(rec.fields, sourceField) ?? "") : rec.message ?? "";
+    if (text2 === "") return null;
+    try {
+      return extractByRegex(text2, new RegExp(spec.pattern));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readDuration(rec, opts) {
+  if (opts.durationField !== void 0) {
+    const raw = readPath(rec.fields, opts.durationField);
+    if (typeof raw === "number" && Number.isFinite(raw)) {
+      return opts.durationFieldUnit === "s" ? raw * 1e3 : raw;
+    }
+    if (typeof raw === "string") return parseDurationMs(raw);
+    return null;
+  }
+  const msg = rec.message ?? "";
+  if (msg === "") return null;
+  if (opts.durationPattern !== void 0) {
+    let isolated;
+    try {
+      isolated = extractByRegex(msg, new RegExp(opts.durationPattern));
+    } catch {
+      isolated = null;
+    }
+    return isolated !== null ? parseDurationMs(isolated) : null;
+  }
+  return parseDurationMs(msg);
+}
+function extractDurationSamples(records, opts) {
+  const needle = opts.completionText?.toLowerCase();
+  const out2 = [];
+  for (const rec of records) {
+    if (needle !== void 0) {
+      const hay = (rec.message ?? "").toLowerCase();
+      if (!hay.includes(needle)) continue;
+    }
+    const dimension = readDimension(rec, opts.dimension);
+    if (dimension === null) continue;
+    const durationMs = readDuration(rec, opts);
+    if (durationMs === null || !Number.isFinite(durationMs)) continue;
+    out2.push({ dimension, durationMs });
+  }
+  return out2;
+}
+function aggregateDurations(samples, dimensionName) {
+  if (samples.length === 0) return null;
+  const grouped = /* @__PURE__ */ new Map();
+  for (const s5 of samples) {
+    const list = grouped.get(s5.dimension);
+    if (list === void 0) grouped.set(s5.dimension, [s5.durationMs]);
+    else list.push(s5.durationMs);
+  }
+  const byValue = {};
+  for (const [value, durations] of grouped) {
+    byValue[value] = computeStat(durations);
+  }
+  return {
+    dimension: dimensionName,
+    unit: "ms",
+    byValue,
+    sampleCount: samples.length
+  };
+}
+function durationsByDimension(records, opts) {
+  const samples = extractDurationSamples(records, opts);
+  return aggregateDurations(samples, opts.dimension.name);
+}
+
 // ../../packages/connectors/src/factory.ts
 init_cjs_shims();
 
@@ -72522,6 +72683,33 @@ var ElasticsearchLogsProvider = class {
     }
     return analysis;
   }
+  async analyzeDurations(opts) {
+    try {
+      const q2 = {
+        level: opts.level ?? "info",
+        limit: opts.limit ?? 500,
+        ...opts.service !== void 0 ? { service: opts.service } : {},
+        ...opts.from !== void 0 ? { from: opts.from } : {},
+        ...opts.to !== void 0 ? { to: opts.to } : {},
+        ...opts.completionText !== void 0 ? { text: opts.completionText, broadText: true } : {}
+      };
+      const records = await this.searchLogs(q2);
+      const normalized = records.map((r) => ({
+        message: r.message,
+        fields: {
+          ...r.raw,
+          ...r.context !== void 0 ? { context: r.context } : {},
+          ...r.eventCode !== void 0 ? { event_code: r.eventCode } : {},
+          ...r.service !== void 0 ? { service_name: r.service } : {},
+          ...r.detail !== void 0 ? { detail: r.detail } : {},
+          message: r.message
+        }
+      }));
+      return durationsByDimension(normalized, opts);
+    } catch {
+      return null;
+    }
+  }
   async checkCompatibility(opts) {
     const fields = [
       this.mapping.timestampField,
@@ -72742,6 +72930,85 @@ function compareWindows(baseline, current, spikeRatio = 1.5) {
   comparisons.sort((a2, b5) => b5.delta - a2.delta);
   return comparisons;
 }
+function quantileSorted(sortedAsc, p5) {
+  const n4 = sortedAsc.length;
+  if (n4 === 0) return NaN;
+  if (n4 === 1) return sortedAsc[0];
+  const pos = (n4 - 1) * p5;
+  const lo = Math.floor(pos);
+  const hi = Math.ceil(pos);
+  if (lo === hi) return sortedAsc[lo];
+  const frac = pos - lo;
+  return sortedAsc[lo] * (1 - frac) + sortedAsc[hi] * frac;
+}
+function median(values2) {
+  const finite = values2.filter((v4) => Number.isFinite(v4));
+  if (finite.length === 0) return NaN;
+  const sorted = [...finite].sort((a2, b5) => a2 - b5);
+  return quantileSorted(sorted, 0.5);
+}
+function detectBimodalPopulation(comparisons, opts) {
+  const spike = opts?.spike ?? 1.5;
+  const drop = opts?.drop ?? 0.67;
+  const minShare = opts?.minShare ?? 0.2;
+  const minMinority = opts?.minMinority ?? 2;
+  const minTotal = opts?.minTotal ?? 3;
+  const gapFactor = opts?.gapFactor ?? 2;
+  const total = comparisons.length;
+  const empty = {
+    bimodal: false,
+    total,
+    highCount: 0,
+    lowCount: 0,
+    degenerateCount: 0,
+    highShare: 0,
+    lowShare: 0,
+    highRatio: NaN,
+    lowRatio: NaN
+  };
+  const highRatios = [];
+  const lowRatios = [];
+  let degenerateCount = 0;
+  for (const c4 of comparisons) {
+    const r = c4.ratio;
+    if (!Number.isFinite(r)) {
+      degenerateCount += 1;
+    } else if (r >= spike) {
+      highRatios.push(r);
+    } else if (r > 0 && r <= drop) {
+      lowRatios.push(r);
+    } else if (r === 0) {
+      degenerateCount += 1;
+    }
+  }
+  const highCount = highRatios.length;
+  const lowCount = lowRatios.length;
+  const counterCount = lowCount + degenerateCount;
+  const result = {
+    ...empty,
+    highCount,
+    lowCount,
+    degenerateCount,
+    highShare: total > 0 ? highCount / total : 0,
+    lowShare: total > 0 ? counterCount / total : 0,
+    highRatio: median(highRatios),
+    lowRatio: median(lowRatios)
+  };
+  if (total < minTotal) return result;
+  if (highCount < 1 || counterCount < 1) return result;
+  if (counterCount < minMinority) return result;
+  if (result.lowShare < minShare) return result;
+  if (highCount < minMinority && result.highShare < minShare) return result;
+  if (lowCount > 0) {
+    const hi = result.highRatio;
+    const lo = result.lowRatio;
+    if (Number.isFinite(hi) && Number.isFinite(lo) && lo > 0 && hi / lo < gapFactor) {
+      return result;
+    }
+  }
+  result.bimodal = true;
+  return result;
+}
 
 // ../../packages/connectors/src/grafana/panels.ts
 init_cjs_shims();
@@ -72869,8 +73136,19 @@ function classifyAnomaly(kind, cmp, opts) {
 }
 function buildFindings(dashboardUid, panelTitle, kind, baseline, current) {
   const comparisons = compareWindows(baseline, current);
+  const bimodal = detectBimodalPopulation(comparisons);
+  const spike = 1.5;
+  const drop = 0.67;
+  const isBimodalMember = (cmp) => {
+    const r = cmp.ratio;
+    if (!Number.isFinite(r)) return true;
+    if (r >= spike) return true;
+    if (r === 0) return true;
+    return r > 0 && r <= drop;
+  };
   return comparisons.map((cmp) => {
-    const anomaly = classifyAnomaly(kind, cmp);
+    const baseAnomaly = classifyAnomaly(kind, cmp);
+    const anomaly = bimodal.bimodal && baseAnomaly !== "none" && isBimodalMember(cmp) ? "bimodal-population" : baseAnomaly;
     const currentSeries = current.find((s5) => {
       const keys = Object.keys(cmp.labels);
       return keys.every((k3) => s5.labels[k3] === cmp.labels[k3]);
@@ -72901,6 +73179,8 @@ function anomalyLabel(anomaly) {
       return "Queue Growth";
     case "change":
       return "Change";
+    case "bimodal-population":
+      return "Bimodal Population (possible per-segment variance)";
     case "none":
       return "No Anomaly";
   }
@@ -72915,6 +73195,11 @@ function anomalyRelevance(anomaly) {
       return 0.8;
     case "change":
       return 0.55;
+    // Lower than a confident single-cause spike: a two-population pattern is a
+    // hypothesis ("per-segment variance"), not a uniform regression — keep the
+    // engine honest by NOT presenting it with spike-level weight (HOR-435).
+    case "bimodal-population":
+      return 0.6;
     case "none":
       return 0;
   }
@@ -74045,6 +74330,37 @@ var AxiomProvider = class {
       return [];
     }
   }
+  /**
+   * INFO-level duration coverage (HOR-434). Query NON-error completion/duration rows
+   * (e.g. `Completed MANAGE_SALES:KSA ~2m10s`) and aggregate duration by an extracted
+   * dimension (region / market / tenant) — from a structured field or a regex over the
+   * job id / message. Returns per-dimension stats `{ region: { KSA: {avg,p95,count,…} } }`
+   * so the engine sees per-segment variance the error-biased `collect()` path misses.
+   *
+   * Graceful: no completion rows, no parseable duration, or no extractable dimension
+   * → `null`. Never throws.
+   */
+  async analyzeDurations(opts) {
+    try {
+      const to = opts.to ?? (/* @__PURE__ */ new Date()).toISOString();
+      const from = opts.from ?? new Date(
+        Date.parse(to) - (this.opts.windowMs ?? DEFAULT_WINDOW_MS)
+      ).toISOString();
+      const apl = buildApl(
+        this.opts.dataset,
+        opts.completionText !== void 0 ? [opts.completionText] : [],
+        opts.limit ?? 500
+      );
+      const rows = await this.client.query(apl, from, to);
+      const normalized = rows.map((rec) => ({
+        message: pickField2(rec.fields, MESSAGE_FIELDS) ?? "",
+        fields: rec.fields
+      }));
+      return durationsByDimension(normalized, opts);
+    } catch {
+      return null;
+    }
+  }
   async health() {
     return this.client.health();
   }
@@ -92806,6 +93122,36 @@ function generateHypotheses(evidence2, _correlation, ctx) {
     contradictingEvidenceIds: [],
     missingEvidence: infraSupport.length > 0 ? [] : ["Infrastructure metrics + datastore/cache state (`horus metrics`)"]
   });
+  const benignSupport = [
+    .../* @__PURE__ */ new Set([
+      ...ctx.perDimensionDurationEvIds ?? [],
+      ...ctx.bimodalMetricEvIds ?? []
+    ])
+  ];
+  if (benignSupport.length > 0 || ctx.benignVarianceApplicable === true) {
+    hyps.push({
+      id: globalThis.crypto.randomUUID(),
+      category: "benign-variance",
+      statement: "The anomaly may reflect expected per-segment/per-region variance (or a skewed average), not a failure.",
+      confidence: 0.1,
+      supportingEvidenceIds: benignSupport,
+      contradictingEvidenceIds: [],
+      missingEvidence: benignSupport.length > 0 ? [] : [
+        "Per-segment duration breakdown (region/market/tenant) or a bimodal metric distribution (`horus logs` / `horus metrics`)"
+      ]
+    });
+  }
+  const suggested = new Set(ctx.alertSuggestedCategories ?? []);
+  if (suggested.size > 0) {
+    for (const h3 of hyps) {
+      if (suggested.has(h3.category) && h3.supportingEvidenceIds.length === 0) {
+        h3.missingEvidence = [
+          ...h3.missingEvidence,
+          "Suggested by the alert/hint text \u2014 confidence requires independent evidence, not the alert wording itself"
+        ];
+      }
+    }
+  }
   hyps.sort((a2, b5) => b5.confidence - a2.confidence);
   return hyps;
 }
@@ -92853,6 +93199,26 @@ function validateHypotheses(hyps, evidence2) {
       rationale
     };
   });
+  const SHARED_EVIDENCE_CEILING = 0.75;
+  const bySupport = /* @__PURE__ */ new Map();
+  for (const v4 of validated) {
+    if (v4.contradictingPresent > 0) continue;
+    const presentSupport = v4.supportingEvidenceIds.filter((id) => present.has(id)).sort();
+    if (presentSupport.length === 0) continue;
+    const key = presentSupport.join("|");
+    const list = bySupport.get(key);
+    if (list === void 0) bySupport.set(key, [v4]);
+    else list.push(v4);
+  }
+  for (const cohort of bySupport.values()) {
+    if (cohort.length < 2) continue;
+    for (const v4 of cohort) {
+      if (v4.confidence > SHARED_EVIDENCE_CEILING) {
+        v4.confidence = SHARED_EVIDENCE_CEILING;
+        v4.rationale = v4.rationale.replace(/\.$/, "") + `; capped at ${SHARED_EVIDENCE_CEILING} \u2014 shares all supporting evidence with ${cohort.length - 1} other hypothesis(es) and nothing distinguishes them.`;
+      }
+    }
+  }
   validated.sort((a2, b5) => {
     const aElim = a2.verdict === "eliminated" ? 1 : 0;
     const bElim = b5.verdict === "eliminated" ? 1 : 0;
@@ -95004,6 +95370,46 @@ function looksPerformance(hint) {
     hint
   );
 }
+function looksDurationThemed(hint) {
+  return looksPerformance(hint) || /\b(duration|took|elapsed|anomal(?:y|ies|ous)|spike|variance|regress(?:ion|ed)?|p\d{2})\b/i.test(
+    hint
+  );
+}
+function parseSuggestedCauses(hint) {
+  const SUGGESTIVE = /\b(could indicate|may be|might be|maybe|possibly|suggest(?:s|ing|ed)?|likely (?:caused|due)|points? to|consistent with|indicat(?:es|ive)|appears? to be|seems? to be|probably)\b/i;
+  if (!SUGGESTIVE.test(hint)) return [];
+  const CATEGORY_CUES = [
+    ["deployment-regression", /\b(deploy(?:ment|ed)?|release|rollout|regression|recent change|shipped)\b/i],
+    ["infrastructure", /\b(database|db|infra(?:structure)?|network|cache|disk|memory|cpu|oom|out of memory|connection pool|datastore|redis|mongo|postgres)\b/i],
+    ["external-api-latency", /\b(upstream|external api|third[- ]party|downstream|api latency|timeout|slow (?:api|service)|gateway)\b/i],
+    ["retry-storm", /\b(retr(?:y|ies)|retry storm|thundering herd|amplif)/i],
+    ["queue-backlog", /\b(queue|backlog|consumer lag|enqueue)\b/i],
+    ["worker-slowdown", /\b(worker|consumer)\b/i],
+    ["benign-variance", /\b(per[- ]segment|per[- ]region|skew(?:ed)?|variance|expected variation|noise)\b/i]
+  ];
+  const out2 = [];
+  for (const [category, cue] of CATEGORY_CUES) {
+    if (cue.test(hint)) out2.push(category);
+  }
+  return out2;
+}
+function formatDurationMs(ms) {
+  if (!Number.isFinite(ms) || ms < 0) return "?";
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  const totalSec = ms / 1e3;
+  if (totalSec < 60) {
+    const s5 = Math.round(totalSec * 10) / 10;
+    return `${s5}s`;
+  }
+  const totalMin = Math.floor(totalSec / 60);
+  const remSec = Math.round(totalSec % 60);
+  if (totalMin < 60) {
+    return remSec > 0 ? `${totalMin}m${remSec}s` : `${totalMin}m`;
+  }
+  const h3 = Math.floor(totalMin / 60);
+  const remMin = totalMin % 60;
+  return remMin > 0 ? `${h3}h${remMin}m` : `${h3}h`;
+}
 var SOURCE_IMPACT_RE = [
   /\bwhat depends on\b/i,
   /\bblast[- ]?radius\b/i,
@@ -95154,6 +95560,7 @@ async function investigate(input, deps) {
   const hint = input.hint.trim();
   const intent = classifyIntent(hint, input.since);
   const namedSymbols = parseNamedSymbols(hint);
+  const alertSuggestedCategories = parseSuggestedCauses(hint);
   const sourceImpactHint = intent === "source-impact";
   const preferNamed = sourceImpactHint && namedSymbols.length > 0 ? namedSymbols[0] : void 0;
   const evidence2 = [];
@@ -95478,6 +95885,7 @@ async function investigate(input, deps) {
   const logEvIds = [];
   const directLogEvIds = [];
   const ambientLogEvIds = [];
+  const perDimensionDurationEvIds = [];
   const directSignatures = [];
   const directEvIdByKey = /* @__PURE__ */ new Map();
   const seedEmittedJoins = [];
@@ -95896,6 +96304,55 @@ async function investigate(input, deps) {
       axiomCollected = false;
     }
   }
+  if (looksDurationThemed(hint)) {
+    const from = logWindowFrom(input.logsSince ?? input.since);
+    const baseDurationOpts = input.durationDimension ?? {
+      // Conservative default for the common `Completed <JOB>:<REGION> ~2m10s` shape: extract an
+      // alphanumeric token after a colon as the dimension, scoped to completion lines, parsing
+      // the duration out of the message. A non-matching corpus yields null (graceful).
+      dimension: { name: "region", pattern: ":\\s*([A-Za-z][\\w-]+)" },
+      completionText: "Completed"
+    };
+    const durationOpts = {
+      ...baseDurationOpts,
+      from: baseDurationOpts.from ?? from,
+      ...input.service !== void 0 && baseDurationOpts.service === void 0 ? { service: input.service } : {},
+      level: baseDurationOpts.level ?? "info"
+    };
+    const durationProviders = [];
+    if (deps.logs && typeof deps.logs.analyzeDurations === "function") {
+      durationProviders.push({ source: "elasticsearch", analyze: (o5) => deps.logs.analyzeDurations(o5) });
+    }
+    if (deps.axiom && typeof deps.axiom.analyzeDurations === "function") {
+      durationProviders.push({ source: "axiom", analyze: (o5) => deps.axiom.analyzeDurations(o5) });
+    }
+    for (const provider of durationProviders) {
+      try {
+        const result = await provider.analyze(durationOpts);
+        if (result === null) continue;
+        const values2 = Object.entries(result.byValue);
+        if (values2.length === 0) continue;
+        const summary2 = values2.sort((a2, b5) => b5[1].avg - a2[1].avg).map(([val, st3]) => `${val} ${formatDurationMs(st3.avg)}`).join(", ");
+        const ev = mkEv(
+          "log",
+          `Duration by ${result.dimension}: ${summary2}`.slice(0, 220),
+          {
+            source: provider.source,
+            kind: "duration-by-dimension",
+            dimension: result.dimension,
+            unit: result.unit,
+            byValue: result.byValue,
+            sampleCount: result.sampleCount
+          },
+          {},
+          void 0,
+          0.6
+        );
+        perDimensionDurationEvIds.push(ev.id);
+      } catch {
+      }
+    }
+  }
   let stateAnalysis = null;
   const stateEvIds = [];
   const stateCollections = /* @__PURE__ */ new Set();
@@ -95986,6 +96443,7 @@ async function investigate(input, deps) {
   const METRICS_TIMEOUT_MS = 3e4;
   const metricEvIds = [];
   const latencyMetricEvIds = [];
+  const bimodalMetricEvIds = [];
   const queueMetricEvIds = [];
   const queueMetricEvIdsByQueue = /* @__PURE__ */ new Map();
   const nominalMetricEvIds = [];
@@ -96037,6 +96495,8 @@ async function investigate(input, deps) {
           );
           const genericPerf = serviceFilter.length === 0 && hintIsPerf && f5.anomaly === "latency-spike";
           if (matchesService || matchesHint || genericPerf) latencyMetricEvIds.push(ev.id);
+        } else if (f5.anomaly === "bimodal-population") {
+          bimodalMetricEvIds.push(ev.id);
         } else if (f5.anomaly === "queue-growth") {
           const panelNorm = f5.panelTitle.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
           const labelNorms = Object.values(f5.labels).map(
@@ -96107,7 +96567,13 @@ async function investigate(input, deps) {
     sinceProvided: input.since !== void 0,
     suppressRuntimeHypotheses: sourceImpactHint,
     recentChangeRelevant,
-    graph
+    graph,
+    // HOR-435: per-segment duration breakdown (#2) + bimodal-population metric (#3) support
+    // the benign-variance hypothesis (#4); the suggested categories de-anchor alert text (#1).
+    perDimensionDurationEvIds,
+    bimodalMetricEvIds,
+    benignVarianceApplicable: looksDurationThemed(hint) || perDimensionDurationEvIds.length > 0 || bimodalMetricEvIds.length > 0 || latencyMetricEvIds.length > 0,
+    alertSuggestedCategories
   });
   const validated = validateHypotheses(hyps, evidence2);
   const causeChains = buildCauseChains(validated, evidence2, graph, label);
@@ -119235,6 +119701,8 @@ function anomalyLabel2(anomaly) {
       return "QUEUE-GROWTH";
     case "change":
       return "CHANGE";
+    case "bimodal-population":
+      return "BIMODAL-POPULATION";
     case "none":
       return "OK";
   }
@@ -121374,6 +121842,120 @@ function extractPort2(hostUrl) {
 init_cjs_shims();
 var import_picocolors44 = __toESM(require_picocolors(), 1);
 var DEFAULT_DB_URL4 = "postgresql://horus:horus@localhost:5433/horus";
+var CONNECTOR_CHECKS = {
+  // Elasticsearch (runtime logs)
+  elasticsearch: {
+    label: "Elasticsearch",
+    absentNext: "add connectors.elasticsearch to an environment in your Horus config for runtime log evidence",
+    check: (es, ctx) => !es.indexPattern ? {
+      label: "Elasticsearch",
+      status: "warn",
+      detail: `${ctx} \u2014 indexPattern not set`,
+      next: "set indexPattern in connectors.elasticsearch"
+    } : {
+      label: "Elasticsearch",
+      status: "pass",
+      detail: `${ctx} \u2014 ${es.indexPattern} [runtime ingestion pending]`
+    }
+  },
+  // Grafana (metrics)
+  grafana: {
+    label: "Grafana",
+    absentNext: "add connectors.grafana to an environment for metric evidence",
+    check: (g4, ctx) => !g4.url ? {
+      label: "Grafana",
+      status: "warn",
+      detail: `${ctx} \u2014 URL not set`,
+      next: "set grafana.url or grafana.urlEnv in your Horus config"
+    } : {
+      label: "Grafana",
+      status: "pass",
+      detail: `${ctx} \u2014 URL configured${g4.dashboard ? ` (${g4.dashboard})` : ""} [runtime ingestion pending]`
+    }
+  },
+  // MongoDB (state)
+  mongodb: {
+    label: "MongoDB",
+    absentNext: "add connectors.mongodb to an environment for database state evidence",
+    check: (m5, ctx) => !m5.url ? {
+      label: "MongoDB",
+      status: "warn",
+      detail: `${ctx} \u2014 URL not set`,
+      next: "set mongodb.url or mongodb.urlEnv in your Horus config"
+    } : {
+      label: "MongoDB",
+      status: "pass",
+      detail: `${ctx} \u2014 ${m5.database} [runtime ingestion pending]`
+    }
+  },
+  // Postgres (state)
+  postgres: {
+    label: "Postgres",
+    absentNext: "add connectors.postgres to an environment for database state evidence",
+    check: (p5, ctx) => !p5.url ? {
+      label: "Postgres",
+      status: "warn",
+      detail: `${ctx} \u2014 URL not set`,
+      next: "set postgres.url or postgres.urlEnv in your Horus config"
+    } : {
+      label: "Postgres",
+      status: "pass",
+      detail: `${ctx} \u2014 ${p5.database ?? p5.schema ?? "postgres"} [runtime ingestion pending]`
+    }
+  },
+  // Sentry (error tracking)
+  sentry: {
+    label: "Sentry",
+    absentNext: "add connectors.sentry to an environment for error-tracking evidence",
+    check: (s5, ctx) => {
+      const tokenSet = s5.authToken || process.env[s5.authTokenEnv ?? "SENTRY_AUTH_TOKEN"];
+      return !tokenSet ? {
+        label: "Sentry",
+        status: "warn",
+        detail: `${ctx} \u2014 auth token not set`,
+        next: "set sentry.authToken or sentry.authTokenEnv (default SENTRY_AUTH_TOKEN) in your Horus config"
+      } : {
+        label: "Sentry",
+        status: "pass",
+        detail: `${ctx} \u2014 ${s5.org}/${s5.project} [runtime ingestion pending]`
+      };
+    }
+  },
+  // Axiom (structured logs) — HOR-437: previously omitted from doctor entirely.
+  axiom: {
+    label: "Axiom",
+    absentNext: "add connectors.axiom to an environment for structured log evidence",
+    check: (a2, ctx) => {
+      const tokenSet = a2.token || process.env[a2.tokenEnv ?? "AXIOM_TOKEN"];
+      return !tokenSet ? {
+        label: "Axiom",
+        status: "warn",
+        detail: `${ctx} \u2014 API token not set`,
+        next: "set axiom.token or axiom.tokenEnv (default AXIOM_TOKEN) in your Horus config"
+      } : {
+        label: "Axiom",
+        status: "pass",
+        detail: `${ctx} \u2014 ${a2.dataset} [runtime ingestion pending]`
+      };
+    }
+  },
+  // Redis / BullMQ (queue + cache/state)
+  redis: {
+    label: "Redis",
+    absentNext: "add connectors.redis to an environment for queue state evidence",
+    check: (r, ctx) => !r.url ? {
+      label: "Redis",
+      status: "warn",
+      detail: `${ctx} \u2014 URL not set`,
+      next: "set redis.url or redis.urlEnv in your Horus config"
+    } : {
+      label: "Redis",
+      status: "pass",
+      detail: `${ctx} \u2014 URL configured [runtime ingestion pending]`
+    }
+  }
+};
+var DOCTOR_CONNECTOR_KEYS = Object.keys(CONNECTOR_CHECKS);
 function mark2(status) {
   if (status === "pass") return import_picocolors44.default.green("\u2713");
   if (status === "warn") return import_picocolors44.default.yellow("~");
@@ -121475,168 +122057,28 @@ async function runDoctor(opts) {
   }
   try {
     const globalConfig2 = await loadConfig(opts?.config, { cwd });
-    let anyEs = false;
-    let anyGrafana = false;
-    let anyMongo = false;
-    let anyPostgres = false;
-    let anySentry = false;
-    let anyRedis = false;
+    const configured = /* @__PURE__ */ new Set();
     for (const project of globalConfig2.projects) {
       for (const env of project.environments) {
         const ctx = `${project.name}/${env.name}`;
         const c4 = env.connectors;
-        if (c4.elasticsearch) {
-          anyEs = true;
-          if (!c4.elasticsearch.indexPattern) {
-            checks.push({
-              label: "Elasticsearch",
-              status: "warn",
-              detail: `${ctx} \u2014 indexPattern not set`,
-              next: "set indexPattern in connectors.elasticsearch"
-            });
-          } else {
-            checks.push({
-              label: "Elasticsearch",
-              status: "pass",
-              detail: `${ctx} \u2014 ${c4.elasticsearch.indexPattern} [runtime ingestion pending]`
-            });
-          }
-        }
-        if (c4.grafana) {
-          anyGrafana = true;
-          if (!c4.grafana.url) {
-            checks.push({
-              label: "Grafana",
-              status: "warn",
-              detail: `${ctx} \u2014 URL not set`,
-              next: "set grafana.url or grafana.urlEnv in your Horus config"
-            });
-          } else {
-            const dashHint = c4.grafana.dashboard ? ` (${c4.grafana.dashboard})` : "";
-            checks.push({
-              label: "Grafana",
-              status: "pass",
-              detail: `${ctx} \u2014 URL configured${dashHint} [runtime ingestion pending]`
-            });
-          }
-        }
-        if (c4.mongodb) {
-          anyMongo = true;
-          if (!c4.mongodb.url) {
-            checks.push({
-              label: "MongoDB",
-              status: "warn",
-              detail: `${ctx} \u2014 URL not set`,
-              next: "set mongodb.url or mongodb.urlEnv in your Horus config"
-            });
-          } else {
-            checks.push({
-              label: "MongoDB",
-              status: "pass",
-              detail: `${ctx} \u2014 ${c4.mongodb.database} [runtime ingestion pending]`
-            });
-          }
-        }
-        if (c4.postgres) {
-          anyPostgres = true;
-          if (!c4.postgres.url) {
-            checks.push({
-              label: "Postgres",
-              status: "warn",
-              detail: `${ctx} \u2014 URL not set`,
-              next: "set postgres.url or postgres.urlEnv in your Horus config"
-            });
-          } else {
-            checks.push({
-              label: "Postgres",
-              status: "pass",
-              detail: `${ctx} \u2014 ${c4.postgres.database ?? c4.postgres.schema ?? "postgres"} [runtime ingestion pending]`
-            });
-          }
-        }
-        if (c4.sentry) {
-          anySentry = true;
-          const tokenSet = c4.sentry.authToken || process.env[c4.sentry.authTokenEnv ?? "SENTRY_AUTH_TOKEN"];
-          if (!tokenSet) {
-            checks.push({
-              label: "Sentry",
-              status: "warn",
-              detail: `${ctx} \u2014 auth token not set`,
-              next: "set sentry.authToken or sentry.authTokenEnv (default SENTRY_AUTH_TOKEN) in your Horus config"
-            });
-          } else {
-            checks.push({
-              label: "Sentry",
-              status: "pass",
-              detail: `${ctx} \u2014 ${c4.sentry.org}/${c4.sentry.project} [runtime ingestion pending]`
-            });
-          }
-        }
-        if (c4.redis) {
-          anyRedis = true;
-          if (!c4.redis.url) {
-            checks.push({
-              label: "Redis",
-              status: "warn",
-              detail: `${ctx} \u2014 URL not set`,
-              next: "set redis.url or redis.urlEnv in your Horus config"
-            });
-          } else {
-            checks.push({
-              label: "Redis",
-              status: "pass",
-              detail: `${ctx} \u2014 URL configured [runtime ingestion pending]`
-            });
-          }
+        for (const key of DOCTOR_CONNECTOR_KEYS) {
+          const cfg = c4[key];
+          if (cfg === void 0) continue;
+          configured.add(key);
+          const run3 = CONNECTOR_CHECKS[key].check;
+          checks.push(run3(cfg, ctx));
         }
       }
     }
-    if (!anyEs) {
+    for (const key of DOCTOR_CONNECTOR_KEYS) {
+      if (configured.has(key)) continue;
+      const desc2 = CONNECTOR_CHECKS[key];
       checks.push({
-        label: "Elasticsearch",
-        status: "warn",
-        detail: "not configured",
-        next: "add connectors.elasticsearch to an environment in your Horus config for runtime log evidence"
-      });
-    }
-    if (!anyGrafana) {
-      checks.push({
-        label: "Grafana",
-        status: "warn",
-        detail: "not configured",
-        next: "add connectors.grafana to an environment for metric evidence"
-      });
-    }
-    if (!anyMongo) {
-      checks.push({
-        label: "MongoDB",
-        status: "warn",
-        detail: "not configured",
-        next: "add connectors.mongodb to an environment for database state evidence"
-      });
-    }
-    if (!anyPostgres) {
-      checks.push({
-        label: "Postgres",
-        status: "warn",
-        detail: "not configured",
-        next: "add connectors.postgres to an environment for database state evidence"
-      });
-    }
-    if (!anySentry) {
-      checks.push({
-        label: "Sentry",
-        status: "warn",
-        detail: "not configured",
-        next: "add connectors.sentry to an environment for error-tracking evidence"
-      });
-    }
-    if (!anyRedis) {
-      checks.push({
-        label: "Redis",
+        label: desc2.label,
         status: "warn",
         detail: "not configured",
-        next: "add connectors.redis to an environment for queue state evidence"
+        next: desc2.absentNext
       });
     }
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.12.3",
+  "version": "0.12.5",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {