C4 — Notifications beyond a CRITICAL-only webhook

[eaitbrahim]

PRD §3 C4.

Today

One integration: WebhookAlertHandler (keel_core/alerting.py) — a logging.Handler attached only at CRITICAL level, POSTing the log record to KEEL_ALERT_WEBHOOK. No URL configured means no handler and zero network calls. There is no Telegram, Discord, Slack, email or SMS integration anywhere (confirmed by grep across .py/.md/.yaml/.plist).

Also present: keel-live-run.sh fires a macOS-only osascript on-screen notification — local only, not remote.

Competitors

Freqtrade has a near-complete Telegram control surface (/status, /profit, /forceexit, /reload_config, /logs) plus per-event webhooks with configurable verbosity. Jesse has Telegram, Discord and Slack drivers with per-message routing and a send_notification=True flag on any strategy log line.

Why this matters beyond convenience

CRITICAL-only means the events an operator most needs are silent, because they are not errors:

• Rail 17's attestation expiring. It has a 7-day TTL and fails closed. When it lapses, cycles keep running and quietly veto every entry — a real setup was vetoed this way and only surfaced when someone opened the TUI.
• A rail arming (drawdown breaker, consecutive-loss halt).
• A cycle that detected a setup and could not place it.
• Month-to-date allowance nearing exhaustion.
• Feed staleness on a product with an open position.

None of these are CRITICAL logs. All of them are things an operator wants to know today rather than next time they look.

Scope — notify-only

• An event taxonomy with per-event opt-in, following Freqtrade's notification_settings shape.
• Keep the generic webhook as the transport; add formatting for at least one chat platform.
• No remote control surface. Every capability-increasing action is TTY-gated by design (D3 — A GUI human gate, architecturally distinct from _is_interactive #436), and a control surface would need that question answered first. Notifications are strictly outbound.

Open question

Does an expiring attestation warrant proactive notification, or is that the operator's calendar problem? Given rail 17 fails closed and silently, it argues for yes.