lookout triage status

Write (or read back) the triage-status record for an incident — diagnosis, action taken, and your severity judgment — so health scans stop reporting it as a fresh unknown and the sentinel stops re-paging followups; the incident playbooks’ closing move.

MCP tool: k8s_triage_status

Usage

lookout triage status [flags]

Flags

Flag	Type	Default	Meaning
--store	string	—	path to the sentinel’s SQLite store (its —store file). Required: triage-status records live in the sentinel’s —store SQLite file; see docs/triage-status-write-design.md
--store-cluster	string	—	read/write the store for THIS cluster, treating —store as the multi-cluster stem the sentinel was given: —store=/var/lib/lookout/lookout.db —store-cluster=prod-us opens /var/lib/lookout/lookout-prod-us.db (issue #410). Set it only against a sentinel running —clusters/—clusters-from; a single-cluster sentinel writes the literal —store path
--fingerprint	string	—	the incident-class fingerprint from the inject payload or store row (sha256:…). Required to write; to read, this or —resource selects the record(s)
--resource	string	—	resource key pinning the record to one object: <KindOfObject>/<namespace>/<name> (namespace segment empty for cluster-scoped objects, e.g. Node//gke-node-1). Required to write
--status	string	—	triage state to record: investigating|triaged|actioned|escalated (resolved is written by the sentinel’s recovery flip, never by agents). Empty = read mode: print the current record(s) instead of writing
--session	string	—	incident session id that produced this record — the paper trail’s pointer back to the transcript
--root-cause	string	—	root-cause hypothesis one-liner
--severity-override	string	—	your routing judgment for further signals of this incident: critical|warning|info (empty = keep the signal’s own class). Honored by sentinel routing and health scans while the record is open
--action	string	—	action taken / paper trail (“fix PR opened; config rollout pending”)

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
triage.status	info	the triage record for an incident subject as it now stands — state, root-cause hypothesis, action, and who wrote it; a receipt, not a defect

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
resource_key	the record’s resource pin, as stored (<KindOfObject>/<namespace>/<name>)
triage_status	the record’s triage state (investigating|triaged|actioned|escalated|resolved)
triage_root_cause	the recorded root-cause hypothesis
triage_action	the recorded action / paper trail
triage_session	the incident session that wrote the record
severity_override	the recorded severity judgment (critical|warning|info), when one is set
updated	when the record last changed, RFC 3339

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout triage status --store=/var/lib/lookout/lookout.db --fingerprint=sha256:e2957792a0b3 --resource=Pod/prod/checkout-697567895d-2gglt --session=sess-0004 --status=triaged --severity-override=warning --root-cause="DB connection string invalid in checkout-config" --action="fix PR opened; config rollout pending"
lookout triage status --store=/var/lib/lookout/lookout.db --fingerprint=sha256:e2957792a0b3
lookout triage status --store=/var/lib/lookout/lookout.db --resource=Pod/prod/checkout-697567895d-2gglt