groups:
  - name: foxhunt.trading.alerts
    rules:
      # CRITICAL TRADING ALERTS
      - alert: TradingServiceDown
        expr: up{job="foxhunt-trading"} == 0
        for: 5s
        labels:
          severity: critical
          component: trading
        annotations:
          summary: "Trading service is down"
          description: "Foxhunt trading service has been down for more than 5 seconds"

      - alert: HighLatency
        expr: foxhunt_order_latency_ms > 10
        for: 30s
        labels:
          severity: critical
          component: trading
        annotations:
          summary: "Order latency is too high"
          description: "Order processing latency is {{ $value }}ms, exceeding 10ms threshold"

      - alert: MaxPositionSizeExceeded
        expr: foxhunt_current_position_size > 1000000
        for: 0s
        labels:
          severity: critical
          component: trading
        annotations:
          summary: "Maximum position size exceeded"
          description: "Current position size {{ $value }} exceeds maximum allowed (1,000,000)"

      - alert: DailyLossThresholdReached
        expr: foxhunt_daily_pnl < -50000
        for: 0s
        labels:
          severity: critical
          component: trading
        annotations:
          summary: "Daily loss threshold reached"
          description: "Daily P&L is {{ $value }}, reaching loss limit of $50,000"

      - alert: CircuitBreakerTriggered
        expr: foxhunt_circuit_breaker_active == 1
        for: 0s
        labels:
          severity: critical
          component: trading
        annotations:
          summary: "Circuit breaker has been triggered"
          description: "Trading circuit breaker is active, all trading halted"

      - alert: OrderRejectionRateHigh
        expr: rate(foxhunt_orders_rejected_total[1m]) > 0.1
        for: 2m
        labels:
          severity: warning
          component: trading
        annotations:
          summary: "High order rejection rate"
          description: "Order rejection rate is {{ $value | humanizePercentage }} over the last minute"

      - alert: PositionManagerError
        expr: increase(foxhunt_position_manager_errors_total[5m]) > 0
        for: 0s
        labels:
          severity: critical
          component: trading
        annotations:
          summary: "Position manager errors detected"
          description: "{{ $value }} position manager errors in the last 5 minutes"

      # RISK MANAGEMENT ALERTS
      - alert: VaRExceeded
        expr: foxhunt_var_current > foxhunt_var_limit
        for: 0s
        labels:
          severity: critical
          component: risk
        annotations:
          summary: "Value at Risk limit exceeded"
          description: "Current VaR {{ $value }} exceeds limit"

      - alert: DrawdownExcessive
        expr: foxhunt_max_drawdown_percent > 10
        for: 0s
        labels:
          severity: critical
          component: risk
        annotations:
          summary: "Excessive drawdown detected"
          description: "Maximum drawdown is {{ $value }}%, exceeding 10% threshold"

      - alert: RiskServiceDown
        expr: up{job="foxhunt-risk"} == 0
        for: 10s
        labels:
          severity: critical
          component: risk
        annotations:
          summary: "Risk management service is down"
          description: "Risk service has been down for more than 10 seconds"

      # MARKET DATA ALERTS
      - alert: MarketDataStale
        expr: time() - foxhunt_last_market_data_timestamp > 5
        for: 0s
        labels:
          severity: critical
          component: data
        annotations:
          summary: "Market data is stale"
          description: "Last market data update was {{ $value }} seconds ago"

      - alert: DataFeedDisconnected
        expr: foxhunt_data_feed_connected == 0
        for: 5s
        labels:
          severity: critical
          component: data
        annotations:
          summary: "Market data feed disconnected"
          description: "Primary market data feed has been disconnected"

      # BROKER CONNECTION ALERTS
      - alert: BrokerConnectionLost
        expr: foxhunt_broker_connected == 0
        for: 10s
        labels:
          severity: critical
          component: broker
        annotations:
          summary: "Broker connection lost"
          description: "Connection to trading broker has been lost"

      - alert: BrokerLatencyHigh
        expr: foxhunt_broker_latency_ms > 50
        for: 1m
        labels:
          severity: warning
          component: broker
        annotations:
          summary: "High broker latency"
          description: "Broker communication latency is {{ $value }}ms"

      # COMPLIANCE ALERTS
      - alert: AuditTrailFailure
        expr: increase(foxhunt_audit_trail_failures_total[5m]) > 0
        for: 0s
        labels:
          severity: critical
          component: compliance
        annotations:
          summary: "Audit trail logging failure"
          description: "{{ $value }} audit trail failures in the last 5 minutes"

      - alert: BestExecutionViolation
        expr: foxhunt_best_execution_violations_total > 0
        for: 0s
        labels:
          severity: warning
          component: compliance
        annotations:
          summary: "Best execution violation detected"
          description: "{{ $value }} best execution violations detected"