Skip to content
oto
Menu
Overview
IntroductionConceptsArchitectureContributingReleasing
Design
oto — System Design ProposalDomain Research: Prometheus Alertmanager + Slackoto — Red-Team Memooto — SCOPE BOUNDARY (the doctrine)oto — BINDING SPECIFICATION v1
ADRs
0001 — PostgreSQL is the sole datastore; River is the job queue0002 — `internal/<domain>/{api,service,repository,domain}` with three model sets0003 — Alert, AlertOccurrence and AlertEvent are three distinct entities0004 — oto owns alert identity; Alertmanager's fingerprint is recomputed, not trusted0005 — A durable group key, and the AlertGroup generation owns the Slack thread0006 — The Alertmanager API v2 reconciler is mandatory, not optional0007 — Webhook response contract: 202 or 503. Never 4xx, never 429.0008 — Slack: `chat.update` in place is primary; threads are secondary; one colour attachment0009 — Rule definitions are snapshotted and versioned at fire time0010 — Server-Sent Events with durable resume, not WebSocket0011 — Validation is seven layers with two opposite trust models0012 — Pastel product chrome, saturated colour reserved exclusively for state0013 — oto is alert-first: the Flight Recorder Test defines the scope boundary0014 — Postgres is the only store; no TSDB or column store in v10015 — No stream processor; River in Postgres is the pipeline0016 — Cluster context arrives via MCP, on demand; never the Kubernetes event firehose0017 — Alertmanager-style matchers, not CEL; and a filter AST that keeps the door open0018 — Slack distribution: a customer-built internal app, credentials in config0019 — MIT licence0020 — Broadcast the transitions that must be seen0021 — Correctness and testing strategy0022 — Length-prefixed identity pre-images0023 — Terminal thread states are decided first, and the send is three phases0024 — Retention defaults, what each boundary destroys, and cold storage0025 — The alert list resolves rule snapshots in a batch, not per row0026 — `refire_grace` and the flap thresholds, derived from a real rule corpus0027 — Delivery drills: a synthetic alert through the real pipeline, and the mark that keeps it out of the numbers0028 — Non-urgency motion: one-shot events, honest activity loops, and nothing else0029 — Type and radius scales, read off the product rather than drawn for it0030 — Tier A repainted as Washi & Ink / Konshi Sutra; accent moves to beni0031 — Sharp corners and higher-contrast grid lines within Washi & Ink; colours unchanged0032 — Dark-theme accent moves from beni to plum-blossom blue-and-white; light untouched0033 — The alert filters are a toolbar above the table, not a panel in the rail0034 — Notifications is a destination, and the record it keeps is readable0035 — Decorative ink as a masked wash: one primitive, four motifs, and the placements it is refused0036 — AlertOccurrence becomes AlertCase, and `case` is argued against FR-1 by name0037 — A Wording is Liquid, and the structure around it stays oto's0038 — The group key is derived from the alert's own labels0039 — Group close stays activity-driven0040 — A Case is `open` or `closed`, and it is never reopened0041 — The Alert/Case allocation, and the one rule that decides it0042 — Storm damping is removed, because the defence was built before its object0043 — The Slack action row renders five elements, and the fifth is the snooze pair0044 — A count condition is a silence the operator asked for, and `below_threshold` is how oto says so0045 — A Case is a conversation, and one Slack thread per alert is the accepted cost0046 — Corners round again: ADR 0031's radius override is reversed0047 — A channel answers to a connection, and Slack gets two scopes back0048 — A Wording is spelled by its channel, and the marks in between are oto's0049 — A Wording is selected by its own clause, not by a route0050 — A NotificationTemplate is one whole message, and its policy says which one0051 — A `raw` template owns the whole message, and a template may carry its replies0052 — An Incident is drawn over Cases, and its response is handed off0053 — An Investigator reads, proposes, and never decides delivery0054 — A Remedy earns the write path0055 — An incident-tool integration is data or a bridge, never code inside oto0056 — A Case the upstream stopped speaking about expires, and says why
Setup
Configuration referenceReaching an incident tool: the envelope, a mapping, or a bridgeInvestigatorsRemediesConnecting oto to SlackThe live Slack verification runTuning otoConnecting oto to VictoriaMetrics (vmalert)The generic webhook and `oto.notification.v1`
Runbooks
oto runbooksAlert search — optional partial/substring matching on alert namesoto_clock_skew_secondsoto_delivery_claim_lost_totaloto_ingest_accepted_totaloto_ingest_alerts_totaloto_ingest_duplicate_totaloto_ingest_duration_secondsoto_ingest_fingerprint_mismatch_totaloto_ingest_process_duration_secondsoto_ingest_rejected_totaloto_ingest_shed_totaloto_job_duration_secondsoto_job_queue_depthoto_jobs_dead_totaloto_jobs_enqueued_totaloto_jobs_failed_totaloto_jobs_panics_totaloto_jobs_snoozed_totaloto_jobs_started_totaloto_jobs_succeeded_totaloto_jobs_unknown_version_totaloto_render_invalid_totaloto_slack_unknown_action_totaloto_stream_connectionsoto_stream_events_coalesced_totaloto_stream_events_dropped_totaloto_stream_events_fetched_totaloto_stream_events_published_totaloto_stream_fetch_errors_totaloto_stream_listener_reconnects_totaloto_stream_notify_malformed_totaloto_stream_notify_received_totaloto_stream_poll_recovered_totaloto_stream_resync_totaloto_thread_gap_recovered_totaloto_thread_head_wait_secondsoto_thread_order_decisions_total

0046 — Corners round again: ADR 0031's radius override is reversed

Status: Accepted · 2026-08-21 · reverses the radius decision of ADR 0031 (not its border-contrast decision, and not ADR 0029’s tier structure)

Context

Section titled “Context”

ADR 0031 took all three radius steps to 0px in service of an Enterprise Technical / Bloomberg Terminal read, and it worked as geometry: every corner in the product went flush. Living with it on the filter bar surfaced the cost. /cases and /alerts both lean on a row of small controls — FilterMenu triggers, Select triggers, Tabs — sitting directly on the content they narrow, and sharp-cornered rectangles at that size and density read as more chrome than the same shapes rounded would, not less: a flush corner on a 28px pill draws a harder edge than the content beside it needs. The technical-grid read ADR 0031 wanted from borders and grid lines survives; the part of it that lived in the corner itself did not earn its keep at control scale.

This is a full reversal, not a partial one. Rounding only the chip-scale controls while leaving buttons, inputs, and panels flush would revive the exact failure mode ADR 0031’s own alternatives section rejected in the other direction — “a smaller radius reads as rounded, just less so” applies symmetrically to “some things round and some don’t.” The system’s chip/control/surface tiers exist to keep one radius decision consistent across every call site of a given kind; carving out one tier’s value by screen would break that guarantee rather than exercise it.

Decision

Section titled “Decision”

All three radius steps return to the values ADR 0029’s census derived them from. Not a new scale, not a re-derivation — the same 3px/4px/6px §M.8 has documented as history since ADR 0029, which ADR 0031 overrode without discarding:

Token ADR 0029 (census) ADR 0031 ADR 0046 (this one)
--oto-radius-chip 3px 0px 3px
--oto-radius-control 4px 0px 4px
--oto-radius-surface 6px 0px 6px

The tier structure, and every call site’s choice of which tier to reach for, is unchanged — a badge still reaches for rounded-chip, a button for rounded-control, a dialog for rounded-surface. Only the value each name renders moves back.

ADR 0031’s border-contrast decision is untouched. --oto-border and --oto-border-strong stay at the higher-contrast values ADR 0031 set — a dense table’s grid lines reading clearly at a glance is independent of whether the cells’ corners are sharp, and nothing here revisits it.

Consequences

Section titled “Consequences”
  • Every rendered corner in the product softens slightly: buttons, inputs, chips, badges, dropdowns, cards, dialogs. rounded-full shapes (avatars, status dots) and explicit rounded-none opt-outs are unaffected, as they were always shapes rather than scale steps.
  • scales.test.ts reads --oto-radius-* off tokens.css and cross-checks it against §M.8 of docs/design/SPEC.md — both were updated together, so the gate stays green without needing its own change.
  • The Linear-derived sandbox under features/ kept its own hardcoded rounded-none throughout, per its own --lp-* token set; it was a separate design surface and was never in scope here. It has since been deleted, so nothing in the tree carries that override any more.
  • §M.8’s amendment note now points at two ADRs in sequence rather than one — the census values, then ADR 0031’s override, then this reversal — which is the accurate history rather than a rewrite of it. A future radius change amends this one the same way, rather than deleting the trail.

Alternatives rejected

Section titled “Alternatives rejected”
  • Round only the filter/tab controls, leave buttons/inputs/panels at 0px. Rejected: it solves the one screen that prompted the question while leaving every other control inconsistent with it, which is the “mix sharp and soft randomly” failure the token scale exists to prevent. A dashboard where the filter bar is soft and the button beside it is sharp reads as two systems, not one.
  • A radius between 0px and the ADR 0029 values (e.g. 2px everywhere). Considered, but there is no census or product reason behind a new number — 3px/4px/6px is what the actual call sites in this product were already using before ADR 0031 touched them, and re-deriving a fourth value with no evidence behind it is exactly what ADR 0029 was written to stop doing.
  • Leave ADR 0031 in place and address the filter bar’s heaviness with tint/spacing/border changes alone. Partially done already — the filter triggers dropped their border and gained a translucent tint in the same pass — but it did not resolve the complaint on its own: a flush corner on a small filled pill still reads harder-edged than the same pill rounded, independent of whether it also has a border.