Pattern of Life — baselines, anomalies & early warning

Pattern of Life plots an entity's activity over time against its normal range and flags the moments it leaves that range, feeding Standing Watches.

Route: /network → timeline view (the <ActivityTimeline> component in app-entity-network.jsx) Data: window.graphData.getActivitySeries(scope, { buckets }) · window.graphData.scoreDeviation(scope) Doctrine: grounding (every spike resolves to observations) · feeds Q10 Standing Watches (§13)

An entity's rhythm is itself a signal. Pattern of Life plots an entity's activity over time against the range it normally sits in, and flags the moments it leaves that range. The question stops being "what happened" and becomes "what happened that shouldn't have."

The baseline band

getActivitySeries returns ~60 time buckets, each with a count, an expected value, a lo/hi baseline band, and an anomaly flag. The band is computed from the entity's own history with robust statistics (median + robust spread), so a single noisy bucket doesn't drag it around and a genuine regime shift stands out. Activity inside the band is normal; activity outside it is worth a look.

The chart draws the band as a filled envelope, the per-bucket counts as bars (blue = normal, red = anomaly), and an anomaly marker dot above flagged buckets. A hover guide line reads out t · n=count · exp=expected · ⚑ for the bucket under the cursor.

Scoring the deviation

scoreDeviation(scope) returns a robust-z deviation against the baseline plus a direction — elevated (busy when it should be quiet) or suppressed (quiet when it should be busy) — and the grounding (the observations behind the call). The header shows e.g. ELEVATED · 2.7σ vs baseline. Direction matters: a dark vessel and a chatty one are opposite stories.

Interacting — brush a window or inspect a moment

Drag across the chart to brush a window: the readout panel reports buckets · total observations · peak · anomalies (vs expected) and a plain-language summary of the span (t12–t28: 84 observations against ~60 expected; contains 3 flagged buckets).
Click a single bar to inspect a moment: count, expected, the band range, and ⚑ ANOMALY / normal status, with the deviation note when flagged.
A scope picker ("Pattern of Life ·") lets you switch which entity you're profiling — pre-filled with the project's top connectors (from graphInsights).
The readout carries actions: Open Entity Inspector → and Show Evidence (the grounding), plus Clear to reset.

From signal to watch

A scored deviation is exactly the trigger a Standing Watch (§13) fires on. Pattern of Life is where the watch's condition is defined and tuned; when activity crosses the band above the watch's confidence, the watch stages a grounded Proposal for a human to act on. The early-warning surface and the autonomy layer are two ends of the same mechanism — the timeline shows you the deviation, the watch turns it into a staged draft, the human commits.

Grounding line

Every spike is one click from the observations behind it; the baseline is derived from real history; the anomaly is scored, not asserted; and the action it triggers still waits for a human. Nothing here publishes on its own.

Prototype boundary

Real now: the activity series + baseline band render; robust-z deviation scoring + direction; brush-a-window and click-a-bucket readouts with live stats; the scope picker seeded from top connectors; the readout actions; the conceptual hand-off to Watches. Deferred: baselines computed continuously from the live fused feed (today they come from the seeded series), and the scheduler that actually evaluates a watch's Pattern-of-Life condition against streaming data.