groups:
  - name: consensus
    rules:
      - alert: BlockTimeTooHigh
        expr: rate(cometbft_consensus_height[1m]) < 0.33
        for: 3m
        labels:
          severity: warning
        annotations:
          summary: "出块时间 > 3s"

      - alert: ValidatorOnlineRateLow
        expr: cometbft_consensus_validators_power / cometbft_consensus_validators_total < 0.8
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "验证节点在线率 < 80%"

      - alert: ConsensusRoundsTooMany
        expr: cometbft_consensus_rounds > 3
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "共识轮次 > 3 未达成共识"

  - name: evm
    rules:
      - alert: TxSuccessRateLow
        expr: rate(evm_tx_success[5m]) / rate(evm_tx_count[5m]) < 0.95
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "交易成功率 < 95%"

      - alert: MempoolTooLarge
        expr: cometbft_mempool_size > 5000
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "待处理交易池 > 5000 笔"

  - name: storage
    rules:
      - alert: DiskUsageHigh
        expr: (1 - node_filesystem_avail_bytes / node_filesystem_size_bytes) > 0.8
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "磁盘使用率 > 80%"

  - name: network
    rules:
      - alert: PeerCountLow
        expr: cometbft_p2p_peers < 10
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "P2P 连接数 < 10"

      - alert: BlockSyncDelayed
        expr: cometbft_consensus_latest_block_height - cometbft_consensus_height > 10
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "区块同步延迟 > 10 blocks"

  - name: relayer
    rules:
      - alert: RelayerBalanceLow
        expr: relayer_wallet_balance_gnx < 10000
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Relayer 热钱包余额 < 10,000 GNX"

  - name: bridge
    rules:
      - alert: BridgeDiscrepancy
        expr: bridge_discrepancy_amount / bridge_eth_locked_amount > 0.0001
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "桥锁定资产偏差 > 0.01%"

  - name: business
    rules:
      - alert: CouponMintSpike
        expr: increase(coupon_minted_total[1h]) > 10 * avg_over_time(increase(coupon_minted_total[1h])[7d:1h])
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "券铸造量异常飙升"

      - alert: LargeTransactionSpike
        expr: increase(large_transaction_total[1h]) > 5 * avg_over_time(increase(large_transaction_total[1h])[7d:1h])
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "大额交易频率突增（可能洗钱）"