Root-cause hypotheses tested against log windows

The decision tree

6 typed decisions, each with an action for every answer

At fixed moments in a run, the engine puts one narrow question to a decision model. The decision model never writes text: it answers yes or no with a probability, picks from listed options, or gives a score, about a small slice of the material. The engine then does exactly what this tree says, which is what makes the run auditable. The thresholds are the template's design values, not measured results.

1. 1

   Planner, while planning

   Scope checkYes or no, with a probability

   Before work starts on a unit

   Does this log window cover the service and the minutes in which the hypothesis predicts something observable?

   Sees only: One prediction and the window's service name and time range

   Why: Pairs with nothing to observe are dropped before two readers are paid to read them.

   00.25 and 0.601

   • Yes: 0.60 or higher→thenAccept
   • Unsure: 0.25 up to 0.60→thenAccept
   • No: below 0.25→thenSkip this unit
2. 2

   After workers, the judge checks

   Evidence checkA choice among options

   After a worker answers

   Do the quoted log lines show the predicted event, such as the connection pool running out, before the first user-facing error rather than after it?

   Sees only: The quoted lines with timestamps and the time of the first user-facing error

   Why: Order in time is what separates a cause from a symptom.

   • Before it: supports the hypothesis→thenAccept
   • Only after it: contradicts the hypothesis→thenAccept
   • Absent from a complete window→thenMark unresolved
   • Window has gaps at the critical time→thenMark unresolved
3. 3

   Reconciler, while merging

   Conflict checkYes or no, with a probability

   While reconciling

   Do the two readers give opposite verdicts on the same prediction for the same window?

   Sees only: Two verdicts with their quoted lines for one prediction and window

   Why: Disagreement between families is the signal that one persuasive story is steering a reader.

   00.30 and 0.601

   • Yes: 0.60 or higher→thenEscalate to a strong model
   • Unsure: 0.30 up to 0.60→thenEscalate to a strong model
   • No: below 0.30→thenAccept
4. 4

   Run control, between rounds

   Retry or stopA choice among options

   After a rejection or low confidence

   Reading both readers' quoted lines together, which verdict do the timestamps support?

   Sees only: Both readers' quoted lines, merged in time order

   Why: Settles only what the log lines settle and leaves the rest visibly open.

   • The supporting reader's lines hold→thenAccept
   • The contradicting reader's lines hold→thenAccept
   • The lines are consistent with both→thenMark unresolved
   • Quoted lines are not in the window→thenReject and retry
5. 5

   Another round?Yes or no, with a probability

   Between rounds

   Does any hypothesis still have untested predictions in windows where logs exist?

   Sees only: The table of hypotheses, predictions and tested windows

   Why: Stops the run when further reading cannot change how the hypotheses rank.

   00.20 and 0.501

   • Yes: 0.50 or higher→thenContinue
   • Unsure: 0.20 up to 0.50→thenContinue
   • No: below 0.20→thenStop
6. 6

   Accountable person, before anything is settled

   Person decidesYes or no, with a probability

   Before anything is reported as settled

   Is this hypothesis about to be reported as the best supported cause while any of its predictions is contradicted or unresolved?

   Sees only: One hypothesis with the verdict for each of its predictions

   Why: The incident commander owns the stated root cause and must see the weak points first.

   Accountable: The incident commander owns the stated root cause and the follow-up actions; the swarm reports evidence, not blame.

   00.10 and 0.301

   • Yes: 0.30 or higher→thenAsk a person
   • Unsure: 0.10 up to 0.30→thenAsk a person
   • No: below 0.10→thenAccept