Edge-native anomaly detection + automation engine (forecasts, alerts, webhooks)

[dcondrey]

Why this is powerful

Today anomalies are surfaced passively on the chart. This turns Facet into a real-time observability + automation platform for your traffic — detect spikes/dips/changepoints the moment they happen at the edge, forecast where a metric is heading with confidence bands, and act (webhook, email, Slack, or reshape the board) via a rules DSL. It is the superset of #11 (conditional boxes) and a standalone product-grade capability, running entirely on Cloudflare Workers + Durable Objects with no external pipeline.

Architecture sketch

• Online detection at the edge: a Durable Object per site maintains streaming state (EWMA + seasonal/STL decomposition + a Bayesian/CUSUM changepoint detector) over the same rollups the realtime window already flushes; flags anomalies with a severity + direction the instant a bucket closes.
• Forecasting: short-horizon forecasts (Holt-Winters / state-space) with prediction intervals, powering goal-pacing ("on track to hit X").
• Automation DSL: persisted rules { when: metric op threshold | anomaly | forecast-breach, do: [webhook, email, slack, board-mutation] }, evaluated server-side; signed webhook deliveries with retries.
• UI: an Alerts tab (rule editor + history), anomaly annotations wired into the traffic box, and forecast bands rendered by TrafficChart.

Subtasks

• Streaming detector in a per-site Durable Object (EWMA + changepoint + seasonality)
• Forecast model + prediction intervals surfaced in the chart
• Rule store + evaluator + signed webhook/email/Slack delivery with retry
• Alerts tab: rule editor, test-fire, delivery history
• Backfill/replay so rules can be validated against history

Hard parts: robust detection with few false positives across wildly different traffic scales, seasonality without heavy deps at the edge, and exactly-once-ish webhook delivery under Workers execution limits.