Sentinel Dispatch

• 

• 

Inspiration

Operations engineers are drowning. During high-load events, studies show up to 99% of pager alerts are false positives. Existing tools like PagerDuty and Datadog aggregate alerts — but they don't classify them. Every event arrives at equal urgency, forcing engineers to triage under cognitive overload at 3am. The real danger isn't the noise. It's when a false-alarm storm masks a genuine incident and the real event gets escalated 20 minutes too late.

I wanted to build a system that thinks before it screams.

What it does

Sentinel Dispatch is a real-time alert triage console that helps operations engineers cut through false-alarm noise and act only on what matters.

When an alert arrives, the ML classifier immediately scores it with a confidence value between 0 and 1 and assigns a recommended action — ESCALATE, WATCH, or SUPPRESS — based on severity. Alerts are sorted in the queue by confidence score, highest first, so the most critical incidents always surface at the top without any manual sorting.

When an engineer expands an alert, Baidu ERNIE analyzes the raw log excerpt and returns a 2-sentence plain-English explanation of whether the alert represents a real incident or a false positive. This analysis appears instantly in the AI ANALYSIS block inside the Decision Panel.

The Confirm button is physically disabled until the engineer has scrolled the full log excerpt to the bottom. This enforces evidence-based decisions at the interaction layer — the system cannot escalate an alert that the analyst has not read. Once the engineer confirms, the alert is removed from the queue and the live counters update.

Engineers can also override the ML recommendation at any time, selecting SUPPRESS, WATCH, or ESCALATE manually. Suppressed alerts move to a persistent drawer at the bottom of the screen where they can be reviewed and restored to the queue if the situation changes. Every decision — confirmed, suppressed, or overridden — is tracked live in the header stat bar.

Keyboard shortcuts C and S allow rapid triage without touching the mouse. A Run Demo button executes the full workflow automatically for demonstration purposes, showing the complete alert lifecycle in under 15 seconds.

How I built it

Sentinel Dispatch was built entirely through structured multi-turn conversation on MeDo across five deliberate turns:

Turn 1 — Data modeling only. No code. I locked the complete Alert data model, component tree, and external API contracts before MeDo was allowed to generate a single line.

Turn 2 — Design system lock. No code. Every color value, typography rule, spacing constraint, and border weight was specified and acknowledged before generation began. Background #F7F5F0, accent #B8860B, Georgia serif for numerals only, 0.5px flat borders, no shadows, no gradients.

Turn 3 — Full application generation. One shot, using Turns 1 and 2 as immovable constraints. MeDo generated the complete React/TypeScript application with all 12 seeded alerts, state management, keyboard shortcuts, and both plugin integrations wired.

Two custom skill packages were built and uploaded before generation:

• ernie-analyst — a ZIP skill package connecting to Baidu ERNIE with a senior operations analyst system prompt, invoked lazily only when an alert card is expanded
• ml-classifier — a ZIP skill package applying confidence scoring rules by severity, returning a float confidence score and a SUPPRESS / WATCH / ESCALATE recommendation for each alert

Turns 4 and 5 added the plugin manifest, the Baidu ERNIE attribution line, page title correction, Run Demo sequence, empty state, and drawer fixes — each turn touching only the specified components.

Challenges I ran into

Credit budget discipline. With 300 starting credits I had to plan every turn to accomplish maximum structural work so no credit was wasted on regeneration. The planning-before-generation protocol was both an AI safety choice and a resource management strategy.

MeDo's custom skill ZIP format. The platform does not support direct API key pasting for external integrations. Each integration required building a properly structured skill package with a SKILL.md file, correct frontmatter, environment variable declarations, and a root directory name matching the name field exactly — then uploading and waiting for parsing before the skill became available in the session.

Drawer overflow. The SuppressedDrawer being fixed at the viewport bottom required dynamic ref-based padding on the main scrollable container to prevent the bottom alert cards from being permanently hidden behind it.

Baidu AI Studio access from India. The ERNIE token page would not load on the standard browser. Resolved by connecting through a Netherlands VPN and verifying the Indian phone number directly on the Baidu registration form.

Accomplishments that I am proud of

The scroll-gated Confirm button is the accomplishment I am most proud of. It is a simple mechanic — one scroll event listener — but it embodies a complete philosophy: AI systems should recommend, not decide. The analyst must read the evidence before the button enables. This is not a UX pattern I have seen in any other alert triage tool, and it emerged directly from thinking about what AI safety means at the interaction layer rather than the model layer.

I am proud of the ERNIE lazy loading architecture. Calling ERNIE for all 12 alerts on page load would have been the obvious implementation — it also would have triggered 12 simultaneous API calls, hammered the rate limit, and slowed the initial render to nothing. The decision to invoke ERNIE only when a card is expanded, with immediate cancellation if the card is collapsed before the response returns, required thinking carefully about the user's actual workflow rather than the simplest technical path.

I am proud of the design discipline. Every color value, typography rule, spacing constraint, and border weight was locked in a dedicated planning turn before MeDo generated a single line of code. The result is an application that has a coherent visual identity — warm paper background, Georgia serif numerals, single amber accent — rather than the generic AI-generated aesthetic that most no-code tools produce by default.

Finally I am proud of the two custom skill packages. Building the ernie-analyst and ml-classifier ZIP packages from scratch, with correct SKILL.md frontmatter, environment variable declarations, prompt engineering, and fallback rules, required understanding MeDo's custom skill system at a level beyond what most participants will attempt.

What I learned

The most important thing I learned is that AI safety is not a disclaimer — it is a design constraint. The decision to make the Confirm button physically disabled until the analyst has scrolled and read the full log excerpt was not a technical afterthought. It was the core interaction philosophy from Turn 1. A system that can recommend but cannot act without human confirmation is fundamentally safer than one that automates the escalation itself.

I also learned that conversational generation on MeDo rewards planning discipline above everything else. The three planning turns before any code was generated produced a more coherent application than any one-shot prompt could have.

What's next for Sentinel Dispatch

The most immediate next step is replacing the mock ML classifier with a real model. The ml-classifier skill is already structured to accept a live webhook URL via environment variable — wiring a trained false-alarm detection model behind that endpoint requires no changes to the frontend. A gradient boosting classifier trained on historical alert data from Prometheus or Datadog would slot directly into the existing architecture.

The second priority is real-time alert ingestion. Currently alerts are seeded statically. Adding a WebSocket connection to a live monitoring source — PagerDuty, Alertmanager, or a custom Kafka consumer — would make Sentinel Dispatch a production-grade triage tool rather than a demonstration. MeDo's plugin system could connect to these sources with minimal additional skill packages.

The third priority is an audit trail. Every confirm, suppress, and override action already updates the alert state — persisting those decisions to a database with analyst identity and timestamp would produce a complete incident response audit log. This is a compliance requirement in regulated industries and a significant differentiator for enterprise adoption.

Longer term, the confidence scoring model could be personalized per team. If an operations team consistently overrides SUPPRESS recommendations for alerts from a specific source, the model should learn that pattern and adjust its confidence scores accordingly. This feedback loop — human override signals retraining the classifier — is the architecture of a genuinely intelligent dispatch system.

Built With

• baidu-ernie
• ernie-analyst-custom-skill
• medo
• ml-classifier-custom-skill
• react
• typescript