Use redacted logs, metrics, deploys, and runbooks to reduce uncertainty without changing production. Rank hypotheses by evidence and state what remains unknown.
Objective
reduce uncertainty without changing production.
Context
time window, logs, metrics, recent deploys, runbooks, redacted traces.
Decompose
timeline, hypotheses, read-only queries, confidence ranking, safe mitigation options.
Criteria
evidence-backed hypothesis and explicit unknowns.
Security
no broad credential access; preserve chain of custody and sensitive data controls.
Rollback
mitigation requires incident commander approval.
Output
timeline, evidence links, next safe action.
Handoff checklist
- Read-only by default
- Evidence links and timestamps
- No broad credential access
- Mitigation requires incident approval
Editorial recipe adapted from the project’s September 2026 research brief. Commands, authority and acceptance tests must be matched to your repository. No production execution is implied.