groups:
  - name: hyb-oa-slo
    rules:
      - alert: HybOAApiAvailabilityLow
        expr: |
          (
            sum(rate(http_server_requests_total{route=~"/api/.*",status!~"5.."}[5m]))
            /
            clamp_min(sum(rate(http_server_requests_total{route=~"/api/.*"}[5m])), 0.001)
          ) < 0.999
        for: 10m
        labels:
          severity: warning
          slo: availability
        annotations:
          summary: "hyb-oa API availability below SLO"
          description: "API availability fell below 99.9% for 10m. Check recent releases and feature-flag changes."

      - alert: HybOADashboardP99High
        expr: |
          histogram_quantile(
            0.99,
            sum by (le, route) (
              rate(http_server_request_duration_seconds_bucket{route=~"/api/dashboard/.*"}[5m])
            )
          ) > 0.5
        for: 15m
        labels:
          severity: warning
          slo: latency
        annotations:
          summary: "hyb-oa dashboard P99 latency above SLO"
          description: "Dashboard API P99 exceeded 500ms for 15m. Investigate DB load and aggregation queries."

      - alert: HybOAApi5xxSpike
        expr: |
          sum(rate(http_server_requests_total{route=~"/api/.*",status=~"5.."}[5m]))
          /
          clamp_min(sum(rate(http_server_requests_total{route=~"/api/.*"}[5m])), 0.001)
          > 0.01
        for: 5m
        labels:
          severity: critical
          slo: availability
        annotations:
          summary: "hyb-oa API 5xx ratio spike"
          description: "API 5xx ratio is above 1% for 5m. Consider force_off for high-risk feature flags."