Proactive Molly

When something on your server spikes or an alert fires, Molly takes a look immediately. She names the likely cause in one sentence, and (when confident) suggests a one-click fix. Phase Б.2 of the roadmap — the second instalment of “AI as operational plane” after zero-shot provisioning.

What you get

• Spike triage — every CPU / RAM / disk spike captured by SpikeDetector triggers a one-shot Molly classifier turn. Confidence > 0.7 → push notification with the diagnosis and a suggested Apply action.
• Alert-event triage — same treatment for every event in the alerting evaluator. 5-minute dedup window per alert ID prevents spam from a noisy alert.
• Hourly cap with digest fallback — 5 triage calls/hour on Free, 10/hour on Pro+. Past the cap, additional diagnoses fold into a single end-of-hour digest notification (Pro+ only).
• Molly Insights card — Dashboard surface showing the last 5 diagnoses with timestamp, sentence, source (spike vs alert), confidence percent, and an Apply button when the action is available to your tier.

How it works

1. Hooks

The Triager subscribes to two event streams the OS already produces:

• SpikeDetector.Subscribe(handler) — the long-running monitoring subsystem fires a SpikeEvent{NodeID, Metric, Value, TopProcesses} when a per-metric threshold trips. The Triager handler runs in its own goroutine outside the SpikeDetector mutex, so a slow Molly call cannot stall the sample loop.
• alerting.Evaluator.SetTriageHook — the alerting evaluator calls the hook after channel notifications fire. The hook runs in a goroutine with panic-recover.

No always-on subsystem; everything is event-driven.

2. One-shot classifier

For each incoming event the Triager builds a short prompt:

• 5-minute system context snapshot (from the existing internal/ai/molly.ContextCollector).
• Spike or alert payload.
• Top-3 processes (for spikes).
• An instruction to respond in JSON only, with {diagnosis, confidence, action?}.

Free tier uses local Ollama; Pro+ unlocks cloud models if you’ve enabled them as your default. The parser is tolerant — markdown-fenced responses get unwrapped, and inner JSON objects get extracted from chatty prose.

3. Push or store

• Confidence > 0.7 → push notification through the existing SystemNotifications surface (web + mobile). The notification carries the proposed Apply action when the model returned one.
• Confidence ≤ 0.7 → log only; visible in the Insights card history but no push.
• Tool-name whitelist — only tools the existing Molly registry recognises are kept on the Apply button. If the model hallucinates a bogus tool, the action is dropped and the diagnosis text remains.

4. Hourly cap + digest

Each node has an in-memory ring counter. Once full:

• Free tier: subsequent diagnoses are silently dropped (with a log entry visible in Insights). Upgrade for the digest.
• Pro+: subsequent diagnoses queue into pendingDigest. A time.AfterFunc re-arms each hour; if pendingDigest is non-empty, a single digest notification fires summarising what happened.

The Insights card

Open Dashboard. Below the running-apps section, you’ll see Molly Insights — a list of the last 5 diagnoses:

• Time — relative timestamp.
• Sentence — Molly’s one-line take.
• Source — spike, alert, etc.
• Confidence — model’s self-reported confidence as a percent.
• Apply — visible when:
  • The action is allowed by your tier (proactive_ai gate).
  • You have operator role (or higher) on the node.

Clicking Apply opens Molly chat with the proposed tool pre-loaded — the chat layer’s ToolCallCard then handles the confirm/execute round-trip through the standard sysctl chokepoint.

API surface

• GET /api/molly/insights/recent — returns the last 5 diagnoses (max 20). Auth-gated.

No new database tables. The Insights live in the Triager’s in-memory ring buffer and are wiped on restart — that’s by design for triage data.

Plans

Surfaced in /api/license/orbit-features as proactive_ai (true on every plan, with different caps) and proactive_ai_digest (Pro+ only).

Limitations & roadmap

• One-click Apply directly from the card — the current build hands off via deep-link to Molly chat. Direct one-click Apply from the Insights card lands in 0.7.7.
• No DB persistence for diagnoses — by design. Restart wipes the ring.
• No cross-node correlation — phase Г cluster scope. A diagnosis on node A doesn’t reference an earlier spike on node B yet.
• No anomaly prediction — the Triager reacts to events; forecasting before a spike is a v2 surface.