incident-investigation

Root cause analysis starts from the emitting monitor query and conducts a time-bounded investigation that synthesizes telemetry findings, emitting-code pins, and pre-declared change correlation. It applies strict evidence validation before producing an operator-ready verdict with cited sources.

Investigating recurring degradation uses time-bounded, evidence-driven probes across telemetry, code, and change history to synthesize findings. It enforces strict declared_at gating to prevent hindsight contamination and requires evidence validation before publishing an operator-ready verdict.

Yes, you can correlate codebase changes with telemetry symptoms through parallel evidence collection. The investigation coordinates a telemetry sweep, change correlation, codebase signal pinning, and hypothesis falsification in one workflow to determine the most likely root cause.

Finding the emitting code location involves codebase signal pinning, which identifies the exact code locations responsible for the telemetry symptoms. The investigation anchors to the emitting monitor query and uses codebase grep to pinpoint the source.

An insufficient evidence verdict occurs when parallel evidence collection probes do not converge on a single root cause. The investigation requires evidence validation with explicit sources and coordinated branch outputs for telemetry facts, code locations, and change mechanisms before publishing.

Yes, incident investigation applies to active incidents, post-incident RCA, and recurring degradation triage. It uses the same monitor-anchored, time-bounded approach with strict declared_at boundaries to ensure evidence-driven probes prevent hindsight contamination across all scenarios.