Flood Warning and Tornado Activity — San Antonio, TX — Contact-Center Operations at Risk

Declared from 1 signals. OVIX 10. News 2. BPO 3. High-confidence (auto).

Auto-validated: SEV4 per policy.

External corroboration: corroborated (4 sources via Exa). sa.gov, forecast.weather.gov, expressnews.com, ksat.com

Auto-closed: no new material events within 12h for this incident.

DECLARE when deterministicFloor AND (llm.declare OR acuteWeatherFloor OR geoExposureFloor) AND NOT aggregateTitle AND NOT footprintZero AND NOT cyberDeny, and no open same-domain incident merges it (see incident_dedup v1). footprintZero (Gate 1, agents-036) = cluster is geo-scoped (any real region) AND bpoScore=0 (resolved exposure negligible/unmatched) — suppresses declaration INCLUDING via acuteWeatherFloor; the event becomes a brief; logged stage=relevance decision=suppress with the exposure inputs. No national-significance escape hatch (revisit with data). cyberDeny (Gate 2, agents-036, domain=cyber only) = isNonCcCyberAsset OR isNonSpecificCyberHeadline over the cluster signal titles (the same asset-class check the Impact Engine gates at 0.15x) — hard deny, logged stage=relevance decision=deny. Additionally a cyber declaration at SEV2 requires active-exploitation/CX-nexus evidence matching /actively exploited|exploited in the wild|under active exploitation|known exploited|kev|ransomware|breach(ed|es)|outage/i in the CLUSTER’S OWN signal titles+messages (never domain-wide news context, never LLM output), else it caps at a brief. Replaces the disabled agents-009 cyberFloor (dead code removed). Geo honesty (agents-036): location_* comes from the declaring event’s own region (top-severity signal), never from a different max-exposure member; cyber declarations set location_* null (exposure cities live in affected_regions only). deterministicFloor = maxSeverity>=8 AND (newsScore>=1 OR bpoScore>=1 OR acuteWeatherFloor). acuteWeatherFloor = maxSeverity>=9 AND any signal is an acute severe-weather WARNING (tornado/severe-thunderstorm/flash-flood) — overrides the LLM footprint-based suppression but NOT the footprint gate. geoExposureFloor (agents-034) = domain in {geopolitical, financial, labor, supply_chain, travel, infrastructure, seismic, disaster, environmental, health} AND maxSeverity>=8 AND bpoScore>=3 (density_class high/very_high — a major member hub); implies footprintZero=false. Weather + cyber excluded. aggregateTitle (grab-bag "Multiple/Several/Various…") is refused (agents-019 §D). Asset-class deny (military/war-zone, WFM-37) suppresses earlier.

Base: SEV2 if sev>=9 AND news>=2 AND bpo>=1; else SEV3 if sev>=8 AND (news>=1 OR bpo>=1); else SEV4. Acute severe-weather (agents-028): if sev>=9 floor to SEV3 (SEV2→SEV3); minor/transient watches+advisories drop SEV2/SEV3→SEV4. Single-event cap: any SEV2 caps to SEV3 absent sustained multi-day BPO-region corroboration (SEV2 promotion is human-gated via revalidation). score = numeric SEV (1=most severe … 4); SEV3/SEV4 auto-validate, SEV1/SEV2 require human validation.