Anomaly detection — TokenTriage Docs

TokenTriage watches spend for anomalies and surfaces them without a black-box “AI flagged this.” Every card names its detection method verbatim, and every finding carries enough to recompute it by hand.

The detector names its method

The shipped detector is robust-seasonal-v1 — each anomaly card prints that method id verbatim. It works against a seasonal frame (a “normal Tuesday 3 pm”), and a finding’s causes carry their per-dimension BubbleUp contributions, so a spike is attributed to the dimensions that drove it rather than left as an undifferentiated total.

An anomaly card naming robust-seasonal-v1, with per-dimension BubbleUp contributions ranking the causes of a cost spike. — An anomaly card — the method named verbatim (robust-seasonal-v1) and per-dimension BubbleUp attribution for the spike.

The empty response is the interesting one

A findings array of length zero means one of two very different things — “we watched these dimensions over this window and nothing was anomalous” or “we watched nothing” — and this surface refuses to let them look alike.

The detection method id travels on the response, on every finding, and on the evaluation. Findings persist in an append-only store with acknowledgement state, surfaced on the standalone Anomalies dashboard destination and embedded in the Overview and Cost surfaces.

Change correlation

Every GET /anomalies response carries a change-correlation block alongside the findings. The change-correlation-v1 method joins each finding’s window against the audit log — config applies (config_apply), decision.policy_rev transitions, and pricing-snapshot changes within a 6-hour lookback — then renders “what changed near this spike,” ranked by temporal proximity and labeled correlation, never causation.

It is served as a sibling block, never merged into a finding: the correlation method id (change-correlation-v1) is deliberately distinct from the detector id (robust-seasonal-v1) so a correlation can never masquerade as a detection. When nothing lines up, the block says so explicitly rather than reaching for a cause.