Anomaly Semantics Reconciliation — cognitive agent-to-agent live demo

demo byChristopher Janz
speed Semantics + pragmatics ON
Two observability systems on one network must share anomaly understanding with no common model. Agent F is a legacy fault manager — RFC 8632 alarms, syslog, SNMP traps, a vendor X.733 probable-cause dictionary. Agent G is an IETF NMOP agent — the RFC 9940 term ladder, anomaly semantics (concern/confidence, action·reason·trigger), and incident correlation. Act 1 reconciles their models; Act 2 runs a live anomaly through and lets pragmatics decide. Toggle semantics + pragmatics ON/OFF to compare with the legacy pipeline.

About this demo — what you're looking at

The problem moves from configuration to observability. Agent F is the incumbent world: an alarm is a catch-all — event, state, a fixed severity (critical/major/minor/warning) and a probable-cause code, all bundled and hard-coded at emission (RFC 8632 / syslog / SNMP / X.733). Agent G speaks the new IETF NMOP vocabulary, where RFC 9940 separates what legacy collapses — event → anomaly → symptom → fault → alarm(a State) → problem(a State) → cause → incident — and Thomas Graf's anomaly-semantics draft annotates each anomaly with concern and confidence scores, action·reason·trigger, a lifecycle stage, and context (network plane, season, maintenance window).

Act 1 — reconcile the models. The two agents lift their vocabularies, anchor a shared reference to the RFC 9940 ladder, and pin the dangerous ambiguities: a fixed severity label is not a dynamic concern score; a static probable-cause code is not a cause derived by correlation; and the overloaded legacy alarm must be decomposed into the several NMOP concepts it conflates. The headline false cognate: a legacy alarm is not an anomaly — an alarm is a declared undesirable State; an anomaly is a deviation that may be perfectly benign.

Act 2 — the anomaly is the trigger, and pragmatics decide. A rising pre-FEC BER anomaly appears on wavelength λ1. Whether it means anything depends not on the data but on its pragmatics: its significance and confidence (act or watch), its context (a planned maintenance window makes the same deviation benign), and its causal role (a symptom, correlated with an IP-layer symptom into one incident with a probable cause — not two uncorrelated pages). Flip the toggle OFF and you get the legacy result: an alarm storm, a false page during maintenance, and no incident. This is the case Thomas Graf and Brad both flagged — in anomalies, pragmatics carry the meaning.

Stage Press ▶ Play to begin. Act 1 reconciles the two observability models; Act 2 runs a live anomaly through and lets the pragmatics — significance, context, causal role — decide what it means.
Cognition load
—
Gap closed by
—
Verified by · measure
—

🟠 Agent F — legacy fault managerRFC 8632 · syslog · SNMP · X.733

🟡 A2A message busTMF Agentic / JSON-RPC

🔵 Agent G — IETF NMOP agentRFC 9940 · anomaly-semantics · incident-yang

Reference · RFC 9940
Alignment
Knowledge graphs & instances
Pin semantics
Anomaly → incident
Pragmatics · context
Exchange mapping
Measures & cognition
Work ledger · storm vs incident
Semantic model
A shared reference for observability, anchored to the RFC 9940 term ladder — the standard that separates what legacy conflates. Each category is agreed by a canonical example. Amber entries have no first-class legacy equivalent (the legacy alarm swallows them).
Two passes. Pass 1 — label: candidates by name. Pass 2 — gloss + example: the RFC 9940 definitions decide. The dangerous cognate: a legacy alarm label-matches an anomaly, but an alarm is a declared undesirable State and an anomaly is a deviation that may be benign.
No alignment yet — press Play.
The lift recovers each implicit model. Legacy has no anomaly / symptom / incident layer; NMOP has the full ladder. Instance co-reference settles which legacy alarm and which NMOP anomaly are about the same underlying condition.

Agent F — lifted legacy model

— not yet lifted —

Agent G — lifted NMOP model

— not yet lifted —

Instance co-reference — which legacy alarm and which NMOP anomaly are the same underlying condition (resource + time)

Instances co-refer in Act 1, stage 8.
The dangerous ambiguities, each pinned to a canonical example so anomaly meaning cannot be misread across the two worlds. These are exactly the places a legacy alarm and an NMOP anomaly quietly disagree.
WhatLegacy (Agent F)NMOP (Agent G)Ambiguity → pinned meaning✓
No semantics pinned yet.
Act 2. A live anomaly is detected, characterised, and — if its pragmatics warrant — promoted to a symptom, correlated with other symptoms into a single incident with a probable cause and a service-impact assessment. With the toggle OFF, the legacy pipeline produces an uncorrelated alarm storm instead.
The anomaly fires in Act 2 (stage 10).
The heart of the anomaly case. An anomaly's meaning is not intrinsic to the data — it depends on its pragmatics. Here the same rising-BER deviation on λ1 is run under different pragmatic contexts, and reaches different verdicts. This is why, in anomalies, pragmatics carry the meaning.
The pragmatics matrix is built in Act 2 (stage 11).
The anomaly pragmatics — carried as first-class annotations (per RFC 9940 + anomaly-semantics)
The negotiated artefact: the observability exchange mapping. F→G lifts a legacy alarm/event into its NMOP constituents (event/anomaly + fault + alarm-State), for correlation. G→F projects an NMOP symptom/incident back to a legacy alarm a legacy console can show. Not inverses — legacy is lossy upward.

F→G — legacy alarm ▶ NMOP constituents

— generated after mediation —

G→F — NMOP symptom/incident ▶ legacy alarm

— generated after mediation —
The per-stage ledger. Verification here: reference categories agreed by canonical example, semantics pinned by canonical instance, and the exchange validated by a worked anomaly, correlated and read back.
StageCognitionClosed byVerified byMeasure
Fills in as stages complete.
The same rising-BER event, both ways. With semantics + pragmatics ON, one anomaly becomes two symptoms and one correlated incident, context suppresses the false alarm, and one page is raised. OFF, the legacy pipeline emits an uncorrelated alarm storm and pages during the maintenance window.
The form-independent observability semantic model — the reconciled meaning (RFC 9940 ladder) with the anomaly pragmatics as first-class annotations and provenance. An agent consumes this directly; the legacy alarm and the NMOP anomaly/incident forms are projections of it. Ad hoc for this network, anchored to RFC 9940 — not universal.
Assembled at the final stage — press Play, or jump with Step.

Legacy view — alarms on resources

critical major minor service on λ1

NMOP view — anomaly · symptom · incident

symptom incident / cause benign (context)
Staged demonstration — the conversation is scripted for legibility; a code-backed run is scaffolded separately. Legacy side: RFC 8632 (ietf-alarms), syslog (RFC 5424), SNMP notifications, X.733-derived vendor probable-cause/severity. NMOP side: RFC 9940 (terminology), draft-ietf-nmop-network-anomaly-semantics, draft-ietf-nmop-network-incident-yang, draft-ietf-nmop-network-anomaly-architecture/lifecycle. A2A envelopes follow the TM Forum Agentic (A2A) JSON-RPC message/send shape.