Serpentine

VECTOR archive › Governance stack › Serpentine

A stream of anomalies is not a description of a system's condition. Six components each reporting mild irregularity may indicate nothing, or may indicate the early stage of a cascade, and no individual signal contains the difference. Serpentine exists to convert many local observations into one global judgement.

Historical context

The need became apparent once more than one protocol consumed Sentinel's output. Each downstream component was applying its own thresholds to the same anomaly stream, which meant they could disagree about whether the system was in trouble — and a containment layer that believes conditions are critical while a rebalancing layer believes they are stable produces incoherent behaviour that is very difficult to diagnose after the fact.

Centralising the judgement is not an efficiency measure. It is what makes the rest of the chain reason from a single shared premise.

Responsibilities

Serpentine owns the definition of system stress: the indices it is computed from, the thresholds at which one level becomes another, and the single classification that is the authoritative answer to "how is the system doing".

Serpentine never owns response. It classifies and stops. Nothing about containment, rebalancing, repair or shutdown belongs here, and the temptation to let the component that knows the state also act on it is exactly the coupling the architecture refuses.

Inputs

Everything Sentinel produces: raw metrics and categorised, severity-scored anomalies.

Outputs

One stress state, from five levels: stable, moderate, critical, failure, catastrophic. Every protocol downstream reads this value.

The states are ordered and the ordering is meaningful — this is a severity scale, not a set of categories — which is what allows downstream components to express their behaviour as thresholds against it rather than as a table of cases.

Internal behaviour

The classification is derived from three indices rather than directly from raw metrics: pressure, congestion and instability.

The intermediate layer is doing real work. It separates three genuinely different ways a system can be in difficulty — pressure is load approaching capacity, congestion is work accumulating faster than it drains, instability is behaviour that will not settle. A single scalar cannot distinguish them, and the appropriate response differs: pressure suggests rebalancing, instability suggests narrowing autonomy.

Thresholds are deliberately severe. Catastrophic requires 92% pressure or 95% instability, and not lower. A classification that fires early is a classification nobody believes, and an escalation chain nobody believes has become decoration — operators route around a system that cries wolf, which removes the protection while leaving the appearance of it.

Interactions

Sentinel → Serpentine → Aegis, Atlas, Punisher, Phoenix, Hyperion
                     ↘ intelligence layer gating

Serpentine executes second, immediately after Sentinel, before any intelligence runs. That ordering is the architectural claim: the system establishes how stressed it is before it decides how ambitious to be. Its output gates the intelligence layer, and is one of the signals feeding VIHAAN.

Failure modes

Misclassification downward — reporting stable while conditions deteriorate — is the serious one. Every protective response in the chain is gated on this value, so an understated classification disables all of them simultaneously. The severe thresholds trade against this: they make catastrophic harder to reach, which is the correct choice for credibility and the wrong one for this failure. The tension is real and unresolved.

Misclassification upward costs capability. Containment engages unnecessarily, intelligence is gated off, the system is more conservative than conditions warrant. Recoverable, and the direction one prefers to fail in.

Oscillation across a threshold produces repeated engagement and disengagement of downstream responses, which is worse than sitting on either side of it. Sustained-signal requirements elsewhere in the chain — notably in VIHAAN — exist partly to damp this.

Design tradeoffs

One global state for a system that may be locally unwell. A single classification cannot express "node seven is failing and everything else is fine". Aegis operates per-node for exactly this reason, but the global state remains a summary, and summaries lose things.

Fixed thresholds in an adaptive system. The levels are constants, not learned. That is consistent with governance before intelligence — the boundary must not move in response to pressure applied to it — and it means the thresholds cannot adapt to a system whose normal operating range has legitimately changed.

Future evolution

The natural extension is regional classification: stress states per subsystem beneath the global one, so containment can be scoped without losing the shared premise. This is inference rather than a stated plan, and it carries an obvious hazard — several stress states can disagree, which reintroduces the incoherence Serpentine was built to remove.