Stack

Layer	Tech	Cost
API	Cloudflare Worker (Hono)	$0
Incidents	D1 (SQLite) — incidents, triage_log, escalation, on-call	$0
Config	KV — tenants/*, secrets/*, keys/*, llm-cache/*	$0
LLM	OpenRouter (free models, 5-model fallback chain)	$0

Data flow

Monitoring Source                Remo API (CF Worker)                 Storage
─────────────────                ────────────────────                 ────────
Prometheus / Alertmanager   POST /ingest ──▶ auth (X-Webhook-Secret)
CloudWatch / Nagios                        │
Zabbix / Instana / Icinga2   ┌─────────────▼─────────────┐
Generic                       │  Multi-source parser       │
                             │  (auto-detect)             │──▶ D1 (incidents)
                             └─────────────┬─────────────┘
                                           │
                             ┌─────────────▼─────────────┐
                             │  Pre-triage enrichment     │──▶ bonito-api (R-007)
                             │  (isDBAlert → fetch ctx)   │
                             └─────────────┬─────────────┘
                                           │
                             ┌─────────────▼─────────────┐
                             │  LLM Router (5-model chain)│──▶ OpenRouter
                             │  cache-first (KV)          │
                             └─────────────┬─────────────┘
                                           │
                 ┌──────────────┬──────────┴─────────┬────────────────┐
                 ▼              ▼                    ▼                ▼
           Slack/Discord   Ticket (Zoho/Jira/SN)  Escalation      On-call
           (chatops)                             (cron, SLA)      (D1)

Pipeline invariants

1. Never lose an alert — the incident row is inserted before triage.
2. Triage is non-blocking — chatops, ticketing and enrichment failures never break the pipeline.
3. Cache-first — repeated alerts reuse the last diagnosis (KV TTL).
4. Dual auth — X-Webhook-Secret (write) vs X-Remo-Key / Firebase Bearer (read).

Auth model

Credential	Header	Purpose
Webhook secret	X-Webhook-Secret	Write: POST /ingest → maps to tenant via secrets/{secret}
API key	X-Remo-Key	Read: /incidents, /metrics → maps via keys/{key}
Admin key	X-Remo-Admin-Key	/tenants CRUD
Firebase	Authorization: Bearer	SaaS mode (app.remo.sofe.dev)

Endpoints

Endpoint	Purpose
POST /ingest	Receive alerts (any supported source)
GET /incidents · GET /incidents/:id	List / detail with triage log
POST /incidents/:id/acknowledge · /resolve	Lifecycle
POST /tenants	Create tenant (auto-generates keys/secrets)
GET /metrics	Incident volume, MTTR, severity breakdown
GET /oncall/current	Who is on call