Reading the root cause report

When an investigation finishes, its findings appear on the incident. This page explains what they mean and how to check them.

Treat it as a lead

A report is a strong first theory from a colleague who read the code and ran the commands. It isn’t a verdict. Models aren’t deterministic, so two runs on the same incident can disagree, and a confident sentence can still be wrong. Evidence names where it came from, so you can check it fast. If a run found nothing to stand on, it says no cause was named rather than inventing one.

No confidence scores, on purpose

You won’t see a likelihood percentage anywhere. A model has no calibrated way to produce one, so a number like that looks precise and means nothing. PrismaLens shows what a score would have summarised: the hypotheses in order, and the evidence for and against each one.

What a report contains

• The likely cause, or a plain statement that none was named.

• Hypotheses, from most to least plausible. The order is the ranking. Each has a status:

  Status	Meaning
  Confirmed	The evidence shows it directly.
  Supported	The evidence points this way but doesn’t prove it.
  Speculative	Plausible, with no evidence yet.
  Refuted	Checked and contradicted.

• Evidence for each hypothesis: whether it’s for or against, what was observed and where, and whether the agent verified it or inferred it.

• Ruled out: causes the agent considered and dropped, with the reason.

• Checked and Not checked. Something under Not checked isn’t an all-clear; nobody looked at it.

• Next steps: what to check or do next.

Checking a hypothesis in two minutes

1. Read the top hypothesis and its status.
2. Run its first piece of evidence yourself: the same command, or the same file.
3. Look at Ruled out before you chase the second hypothesis.
4. If the report is wrong, the run’s steps show where the reasoning went off.

Sharing it

A report exports as Markdown.