Skill: Hypothesis Engine (Working-Theory Ledger)

You can score investigative hypotheses by using a mechanical confidence computation script that evaluates weighted supportive and contradictory signals. This approach rescores active theories at each operational period boundary, ensuring your DFIR triage reasoning reflects the latest evidence.

Preventing investigation anchoring bias requires maintaining an explicit working-theory ledger of 2–3 active hypotheses. By continuously rescoring these theories against new evidence and retiring low-confidence items, you force objective evaluation over subjective assumptions.

You can track hypothesis evolution without overwriting history by using an append-only JSONL ledger. This format records every hypothesis update at analysis/hypotheses.jsonl sequentially, preserving the full investigative reasoning chain for later review.

Yes, Python3 scripts can detect mutually exclusive high-confidence hypotheses by applying defined confidence thresholds. When contradictions are found, they are surfaced directly in the Common Operating Picture's Contradictions table for incident response review.

You should retire a low-confidence working theory during an operational period update when its mechanical confidence score drops below defined thresholds due to stale-decay rules or contradictory evidence. The system then ensures at least one adequately supported hypothesis remains active.

No, hypothesis scoring does not require manual calculation because it uses hypothesis_score.py to compute confidence mechanically. The script automatically evaluates weighted supportive and contradictory signals to generate objective confidence levels.