Evidence levels

A failure review mixes what the logs show, what lines up in time, what someone suspects and what nobody can tell. Foxborne gives each its own evidence level, and the console draws each level with its own shape.

Example data

LevelMeansExample, INC-0142Where it appears

ObservedA value, event or log line captured directly.“perception.service exited at 14:32:04.133.”Every rule result. Report sequence lines start here.

CorrelatedEvents that line up inside a known error bound.“The next heartbeat was due 0.76 s after the router stopped.”Sequence lines, with the bound that supports the order.

HypothesisAn explanation that still needs a check.“The router unit may be bound to the perception unit.”The finding, until a check confirms or refutes it.

UnknownSources are missing, partial, or disagree on time.“Nothing supports an order between the stall and the kill.”Order-unknown pairs, and findings the evidence cannot decide.

What each level claims#

Observed#

A value, event or log line captured directly. "perception.service exited at 14:32:04.133" is observed: the companion journal holds that line, and the report cites its file, line and hash. Rules report at this level, because a rule states only what the sources show.

Correlated#

Events that line up inside a known error bound. In INC-0142 the next heartbeat was due at range control 0.76 s after mavlink-router.service stopped, against a bound of ±0.43 s, so the order holds. Correlated stops short of cause: no log line shows the stop causing the silence.

Hypothesis#

An explanation that still needs a check. INC-0142's finding proposes that the router unit is bound to the perception unit, and calls that binding "a hypothesis until the unit files are checked." The report's 6 Next check names the test that would settle it.

Unknown#

Sources are missing or partial, or they disagree on time. The last obstacle_distance sample and the kernel kill in INC-0142 are 39 ms apart, inside a 46 ms combined bound. Nothing supports an order between them, and Foxborne says so instead of picking one.

Where levels appear#

Rule wording begins Observed: in 12 of the 13 rules. clock_uncertain begins Warning: instead, because it reports a limit on ordering between sources rather than an event.

The finding gets its level from the engineer, in Edit the finding, whose hint defines the three choices:

Observed means the sources show it directly. A hypothesis explains the observations and needs a check. Unknown means the evidence cannot decide.

Correlated is not offered for the finding. It belongs to sequence lines, next to the bound that supports it.

Sequence lines start as Observed, and a line can carry another level with a note. INC-0142's telemetry gap is Correlated: "Due 0.76 s after mavlink-router.service stopped. Bound ±0.43 s including link latency."

Foxborne labels order-unknown pairs itself, so nobody has to remember the caveat. When two events in the sequence sit inside their combined clock error, both lines read Order unknown. E2's note in INC-0142 reads "Order against E3 is unknown: 39 ms apart, inside ±46 ms combined."

How levels look#

The console and the report draw each level with a fixed shape, so a level reads without relying on color:

The report puts a level chip on the finding and in the Level column of the sequence. Its 4 Limitations section then says in plain words why anything is unknown, such as "Their order is not claimed."

Why there are no confidence percentages#

A figure like 91% needs a calibrated model and labeled incidents. Without both, a percentage is a number nobody can check, and a reviewer would have to take it on trust.

A level makes a narrower promise that a reviewer can test. Observed points at a line in a file, and correlated points at two events and the bound between them.

Hypothesis points at the check that would settle it. Unknown points at the missing source or the overlapping bounds. Reviewers get the evidence itself, which is what they sign off on.

Related#

• Alignment and event order explains when two events are ordered and when their order is unknown.
• Reports and case files shows where each level sits on the page.
• Write and review a report covers choosing the finding's level.
• Rules and findings covers the fixed rule wording.