Glossary
Every 3AM term in one place, A to Z, with where to read more. Admin token, autonomy, Keychain, member, pack, proven, restore move, site key, System 1, Warden and the rest.
| Term | Meaning |
|---|---|
| Abandoned | An incident 3AM stopped investigating because it restarted; nothing after its last event was done |
| ActionEvaluator | The deterministic rules that classify every fix as safe, needing approval, or forbidden (Resolution) |
| Admin token | Created at first start. Creates the first owner, then serves automation and break-glass; never a sign-in (Sign-in) |
| Advise / draft | The fix mode. advise gives advice when no pack fix exists; draft drafts a fix and may propose restore moves |
| At the alert | A cause that can only be checked when its alert arrives (the alert names what to look at) |
| Audit log (ledger) | Every event, hash-chained and signed, append-only (Logs and audit) |
| Autonomy | off, shadow, L1, L2, per service (Autonomy) |
| Break-glass | Signing in with the admin token when e-mail can't be sent; logged |
| Bundle | 3am-<version>.tar: images, packs, installer, signed checksums (Air-gapped) |
| Causal discovery | PCMCI+ in 3am-causal, relating the series that shifted (Investigation) |
| Chronic | A cause already true 30 minutes before the alert: not this incident's cause |
| Confidence | proven, linked, suspected, disputed, unproven, cleared |
| Coverage | How many of your services each kind of evidence reaches (Guide) |
| Digest | 3AM's call next to your team's, per service; readiness for L1 (Digest) |
| Disputed | Checks prove it, but System 1 reads the evidence as refuting it: goes to a person |
| Drafted fix | A fix 3AM drafts for a proven cause with no pack fix; two approvers by default |
| Episode | One investigation of one service's alerts, inside an incident |
| Estate | The map of your services, owners, dependencies and where each came from (Estate) |
| Fingerprint | A hash identifying an install for the licence (machine id, cluster UID) |
| Hand-over | The triage sent to people 90 s after the first alert when nothing is proven |
| Home | The install a Keychain lives on (Keychain) |
| Incident | One failure: every related episode, one ticket, one thread (Incidents) |
| Ingest token | Bearer token for POST /v1/events and alert webhooks |
| Install log | The hash-chained history of installs added to and removed from a licence |
| Investigator (System 2) | The language model that reads through read-only actions and writes the note |
| Keychain | One setup for every install (Enterprise, Strategic) |
| L1 / L2 | L1 asks before every fix; L2 also runs safe fixes unasked |
| Linked | A symptom of another incident whose cause is proven |
| Lookback | Your last 90 days of incidents read from ServiceNow or PagerDuty (Impact) |
| MCTS | The tree-search investigator (--investigator mcts) |
| Member | An install that takes its setup from a Keychain's home |
| Mitigate first | At L2, a safe fix before proof on a strong suspect with high impact |
| Pack | Sealed knowledge of a technology: causes, checks, fixes (Packs) |
| Pairing | Joining a Keychain with six digits compared on two screens |
| Proven | A deterministic check passed on live data, not already true before, and (outside packs) a second line agrees |
| Readiness for L1 | ≥ 5 judged proposals, ≥ 80% agreed, none policy would refuse |
| Restore move | When nothing is proven: undo the one change just before, start what stopped, or the declared failover |
| Result | How an incident ended: resolved, restored, handed_over, linked, cleared, shadow |
| The ring | Every key (install) on a Keychain and how each is doing |
| Sealed file | The Keychain in one file under a passphrase, for a site with no network to the home |
| Shadow | Prove, rehearse, record; change nothing. The default |
| Site key | A one-time key the home makes so a new site sets itself up (3AMSITE1.…) |
| Study | A read-only rehearsal of every cause, before anything breaks (Study) |
| System 1 (tev1) | The small model that verifies causes, fixes and sentences, and can veto a fix |
| Tier | Starter, Enterprise, Strategic (Licensing) |
| Warden | 3AM's licence authority (warden.3am.si) |