Grading changelog

Local trouble isn't a blackout #27

• Incidents short of global (one region, carrier, plan or add-on) stop adding points after 6 hours. Global ones still run to 1 day, or 3 for Sev 1.
• Third-party carrier networks (Twilio's "CARRIER NETWORK" components: one operator's SMS or calls in one country) count as local, x0.1.
• Admitted uptime unchanged.

Overlapping incidents count once #23

• Points, overall and for PROD and SHIP, count each minute once, at the worst incident running then. Was the sum, so an outage posted twice cost double.
• Per provider: a stack hit by two providers at once pays for both. The security penalty is unchanged.

Incident timelines #22

• Claude links a new incident to the earlier one it continues, from the provider's titles over the previous 14 days. Security follow-ups within a week of a compromise and near-identical reposts join the same timeline.
• Display only. Grades unchanged.

Exposed credentials are security, not data loss #21

• Railway's Oct 21 incident (rotate env-var credentials) had read as data loss and counted as Sev 1 PROD for two days. Credential exposure now only adds the compromise penalty.

One breach, one security penalty #20

• Compromise incidents starting within 7 days of an earlier one keep the SECURITY pill but add no further penalty points.

Claude held to the rubric #17

• Add-on products are single scope. Rolling restarts with some hosts down are subset. Paused sign-ups and support sites are papercuts.
• Late SMS or calls are Sev 2. Serving and data incidents are never Sev 3, and Sev 1 only when global or unclear.
• "We have observed a recovery" counts as recovered.

Admitted uptime counts customer-minutes #16

• Was widespread Sev 1 only, so 36 of 39 providers read 100.00%. Now minutes × depth (down 1, degraded 0.5) × scope weight, worst incident at each moment, at most a week per incident.
• Provider pages add Fully down: widespread Sev 1 time, unweighted.

Railway-style compromises caught #15

• Revoked tokens, rotated bucket credentials and a named attacker now count as a compromise. Railway's Oct 21 breach had missed the penalty.

Security by impact #14

• A security flag no longer raises the tier. Security incidents are graded on impact like any other.
• The 600-point penalty needs a real compromise: unauthorized access, exposed or leaked credentials, a breach. DDoS, patched vulnerabilities and "not affected" CVE notices score on impact alone.
• Papercuts no longer count toward SHIP. One-region cloud security incidents top out at Sev 2.

Audit fixes #13

• Days without a Sev 1 ignores a Sev 1 after its first week, as the heatmap does.
• Most Sev 1-2 time, 7d counts overlapping incidents once.
• Trends show – for months before our data.

Scope from listed cities 2cdef27

• Rules read scope from the incident: one city is local, up to 10 regional, "some users" a subset. Claude's "unclear" no longer erases a scope the rules found.

Filtered views grade only what you use #11

• With needs picked, the overall grade adds up only the areas they touch: SHIP for Deploys, PROD for the rest.

Penalty stops at recovery f878888

• Once resolved, minutes stop at the first update saying service was back to normal, if earlier than monitoring or resolve.
• Open incidents in monitoring show MONITORING, not DOWN.

Longest counts outages only #6e6dadda

• Sev 1-2 only, and only incidents that began in the window.

Grade only what the data covers #3

• Under 14 days of data gets no grade. Under 90 days shows the days covered.
• Admitted uptime counts only widespread Sev 1s, not one-region ones.
• Duplicate components listed twice by a status page count once. Incidents naming only a provider's own apps are papercuts.

Single scope e54c6c6

• One model, endpoint or add-on among many is single scope, × 0.1.
• Worst lists on provider pages rank by points, not tier.

Penalty capped at a day below Sev 1 5e9ca50

• Sev 1 counts up to 3 days, Sev 2-4 up to 1. Was 3 days for every tier.

Heaviest incidents read first 26a31aa

• Claude reads pending incidents in order of the points they cost, so the ones that decide a grade get checked first.

Database and cloud fixes 15c840335ac4cd

• Database management API, lifecycle and pause incidents are SHIP.
• An AWS event's own region sets its scope.

Narrow features are still serving 40c1c58

• Any product customers build on counts as serving. Narrow impact lowers the scope, not the tier.

Points scale by blast radius 99cfc60

• Points become weight × scope × minutes. Global and unclear × 1, regional and subset × 0.3, one location × 0.1. Security penalties aren't scaled.

Abandoned incidents end cd935e7

• An open incident with no update for 7 days ends at its last update. One left open since August had made an F on its own.

Why this grade f8a42edec161c1

• Every AI-graded incident shows the rules' call, Claude's call, the model, the date and the raw record.
• Long incidents get a short summary from Claude.

Best value 0493311a9967cb

• Best value when nobody in the category costs the same or less with the same or better grade. AI APIs unpriced.

PROD and SHIP d652b26

• Two area grades replace Production, Shipping and Dashboard. PROD: users hit. SHIP: can't deploy, build or manage, including dashboard, auth and billing outages that block it.
• Papercuts count toward the overall grade only.

Claude grades on top of the rules 6aa7edb

• Claude reads each new or changed incident and refines the rules' tier, scope, security and data loss calls. The rules stay as fallback.

First grades #1

• Sev 1-4 from status-page components and levels. Points = weight × minutes over 90 days, capped at 3 days, A+ to F.
• Security incidents at least Sev 2, plus 600 points.
• Admitted uptime = time without a Sev 1.