# Prometheus alerting rules for the TrustPin attestation verifier 1.0.0.
# Instructions: https://docs.trustpin.cloud/attestation/operations
groups:
  - name: trustpin-attest
    rules:
      - alert: AttestVerifierPolicyStale
        expr: time() - trustpin_attest_policy_last_success_timestamp_seconds > 3600
        for: 10m
        labels: {severity: warning}
        annotations:
          summary: "No successful policy refresh for over an hour"
          description: "The verifier keeps serving its last-good policy. Check the TrustPin CDN, TRUSTPIN_ATTEST_CONFIGURATION_URL, and policy_refresh_total by outcome."

      - alert: AttestVerifierPolicyIncompatible
        expr: increase(trustpin_attest_policy_refresh_total{outcome="incompatible"}[15m]) > 0
        labels: {severity: warning}
        annotations:
          summary: "A newer policy needs configuration this instance lacks"
          description: "The published policy requires Play Integrity credentials that are not configured. The verifier stays on the previous version."

      - alert: AttestVerifierUpstreamErrors
        expr: |
          sum by (upstream) (rate(trustpin_attest_upstream_requests_total{outcome!="ok",upstream="play_integrity"}[5m]))
            / sum by (upstream) (rate(trustpin_attest_upstream_requests_total{upstream="play_integrity"}[5m])) > 0.2
        for: 10m
        labels: {severity: warning}
        annotations:
          summary: "{{ $labels.upstream }} failing for more than 20% of calls"
          description: "Attestations answer 502 upstream_unavailable while Google is unreachable; SDKs back off and retry."

      - alert: AttestVerifierForgeries
        expr: sum(rate(trustpin_attest_attestations_total{result="fail",reason=~"chain_invalid|chain_revoked|nonce_mismatch|key_mismatch|counter_invalid|request_hash_mismatch|assertion_invalid|debug_token_invalid"}[5m])) > 1
        for: 5m
        labels: {severity: info}
        annotations:
          summary: "Sustained binding failures (forged or replayed evidence)"

      - alert: AttestVerifierRevocationListStale
        expr: trustpin_attest_revocation_list_age_seconds > 7 * 24 * 3600
        for: 1h
        labels: {severity: warning}
        annotations:
          summary: "Google attestation revocation list older than 7 days"

      - alert: AttestVerifierStoreErrors
        expr: sum(rate(trustpin_attest_store_operations_total{outcome="error"}[5m])) > 0
        for: 5m
        labels: {severity: warning}
        annotations:
          summary: "Store errors: replay protection is degraded"