Write and review a report

The report is the page a review board reads. Its first section is the engineer's conclusion, stamped with the author's name. Everything below it comes from the sources, with the file, location and SHA-256 behind every excerpt. This page covers each section and its dialog, the checklist in the rail and the review, with INC-0142 from the example dataset.

Before you start#

• Investigators and admins write reports. Reviewers comment and approve them, and viewers read approved reports. See Roles and permissions.
• Put the events you need in the sequence from the evidence inspector. See Work an incident.

What the report holds#

The Report tab shows the report as a page. From the top:

1. The marking, such as CUI. When the marking is CUI, the designation indicator follows: Controlled by for the organization and again for the office, then CUI category, Dissemination and POC.
2. Incident report, the incident ID and the title.
3. The header: Vehicle, Run, Location, Sources, Clock, Investigator, Reviewer and Generated.
4. 1 Finding, 2 Sequence, 3 Evidence, 4 Limitations, 5 Open questions and 6 Next check.
5. The footer, which reads "Generated by Foxborne 1.4.2. Every excerpt can be checked against its SHA-256." The marking closes the page.

The Clock line has three other forms: "Companion clock aligned by hand, ±1.04 s. Other sources GPS or NTP anchored.", "The companion clock is not aligned. No order is claimed between the companion and the flight log." and "Elapsed time only."

Write the report#

1. 01

   Choose the sequence

   Edit beside 2 Sequence opens Edit the sequence: "Choose the events the report walks through. Each line keeps its source reference." It lists every event of the incident in time order, each with a checkbox, its time, title and lane. Tick the events the report needs.

   The report sorts the sequence by time, with events on an unaligned companion clock last, and numbers the lines E1, E2, E3.

   Column	What it shows
   Time, UTC	The time, with the bound beneath it: ±6 ms, or ±15 ms, latency 412 ms for a receipt. An unaligned companion event reads own clock and no anchor
   Event	The title, with a note when there is one
   Level	The evidence level. Order unknown marks both events of a pair closer than their combined clock error
   Evidence	The reference, E1 to E8 in INC-0142

   In INC-0142, E2 carries the note "Order against E3 is unknown: 39 ms apart, inside ±46 ms combined." E3 carries the same note against E2. E6, the telemetry gap, reads Correlated, with "Due 0.76 s after mavlink-router.service stopped. Bound ±0.43 s including link latency." An empty sequence reads No events in the sequence yet. Add them from the timeline inspector.

2. 02

   Check the evidence

   3 Evidence has no edit button: Foxborne builds it from the sequence. Each reference gives the title, then the file, location, short SHA-256, parser and event ID, then the excerpt. A journal event quotes its MESSAGE, a JSON record appears compact and a flight log record gives its topic and first three fields.

   E3  Kernel killed perception_node (out of memory)
       uas04-orin-journal.json, Line 18,314, cursor i=5014, sha256:a0741c955f33…cdf4, journal 0.6.0, event 5a705b4a
       Out of memory: Killed process 2213 (perception_node) total-vm:11873248kB, anon-rss:6823516kB, file-rss:10240kB, shmem-rss:0kB, UID:1001 pgtables:14720kB oom_score_adj:0

3. 03

   Write the finding

   Edit beside 1 Finding opens Edit the finding: "One or two sentences, in your words. Say whether it is an observation, a hypothesis or unknown."

   Choose the Level: Observed, Hypothesis or Unknown. The hint reads "Observed means the sources show it directly. A hypothesis explains the observations and needs a check. Unknown means the evidence cannot decide." Then write the Finding. It is required: left empty, it turns red and the dialog stays open. Backticks set parameter names and commands in code.

   Saving stamps the finding: Written by, your name, the date and the time, then "This paragraph is the engineer’s. Everything below it is extracted from the sources." INC-0142's finding is a hypothesis and says so: "The binding is a hypothesis until the unit files are checked."

4. 04

   Record the limitations

   Edit beside 4 Limitations opens Edit limitations: "Missing topics, dropped data, clock uncertainty and manual assumptions. One per line." Blank lines are dropped. Each limitation shows an icon for its kind: order, latency, missing data, scope, clock or manual assumption.

   INC-0142 carries four. The first reads "The last obstacle_distance sample and the kernel kill are 39 ms apart, inside their 46 ms combined clock error. Their order is not claimed." A manual clock alignment adds its own line, and removing the alignment removes it. See Align a clock by hand.

5. 05

   Add open questions

   Add beside 5 Open questions opens Add an open question: "Open questions travel with the case file until someone resolves them." Write the Question, which is required, and select Add question.

   Each question shows its text and who asked it when, with a Resolve button beside it. Resolve takes effect at once and confirms with Question resolved. With no question open, the section reads None.

6. 06

   Write the next check

   Edit beside 6 Next check opens Edit the next check: "One test or measurement that would confirm or refute the finding. Wrap commands in backticks." Left empty, the section reads Not written yet. INC-0142's next check starts on the bench unit with systemctl show mavlink-router.service -p BindsTo -p PartOf -p Requires.

Each save adds a line such as Edited the finding to the report history and records Edited report in the audit log. Foxborne confirms with Saved. The edit is in the report history.

Keep observations apart from conclusions#

The report separates what the sources show from what the engineer concludes:

• The finding is the only section in the engineer's words, and the page says so under it.
• The finding carries its level, Observed, Hypothesis or Unknown, so a hypothesis never reads as an observation.
• Rules report in fixed wording that starts with Observed or Warning, such as "Observed: telemetry receive gap, not necessarily radio failure". The Rules page states it: Rules observe. They never conclude.

Evidence levels explains the four levels and when each applies.

Check the finding against the records#

The finding is free text, so nothing stops a mistyped time or a rounded figure that no record supports. On screen, Foxborne checks it. The AI models list what the finding claims; code then matches each claim to this incident's records. The check marks the text and never changes it.

Each claim is underlined in the finding. A dotted line means it matched; a solid amber line means it did not. Hold the pointer over a claim, or tab to it, for its source. On INC-0142, 34 ms reads "E5, mavlink-router.service stopped is 34 ms after E3, kernel killed perception_node (out of memory). Same clock, so the order holds."

A box under the stamp sums it up. On INC-0143 it reads Checked against the records. "All 8 figures and times it states match the records; every order it claims holds. Hover a marked phrase for its source." A figure no record supports reads "Not found in the records of this incident. If it was worked out by hand, say how in the finding." A cause written as observed reads "States a cause as observed. The records show order and timing; a cause needs an inspection or a test, so write it as a hypothesis."

The marks and the box are for the screen only. Printing and case files carry the engineer's text as written.

Open Review and history#

On the Report tab, the paper takes the full width of the page. Review and history, at the top right beside the status button, opens a drawer subtitled with the incident ID and the report's state, such as INC-0142, report in review. Status shows the state, Draft, In review or Approved, with the reviewer's name. The drawer's footer holds the buttons:

• Print or save as PDF, which closes the drawer and opens the browser's print dialog. The print layout leaves out the console's sidebar, top bar, tabs and header buttons. It also hides every Edit, Add and Resolve.
• Approve report, which the incident's named reviewer sees while the report is In review.
• Export case file. See Export a case file.

Before you export checks the report. For INC-0142 it reads:

A manual clock alignment adds the warning "Uses a manual clock alignment, ±1.04 s". History, marked Every edit is audited, lists every entry with who made it and when, newest first, 8 to a page.

Review and approve#

1. 01

   Read against the evidence

   Read the finding, then check its level against the sequence. For any line you doubt, select the event on the timeline or open its event page, and read the original record. Leave notes on the evidence under Discussion on the event page.

2. 02

   Ask what is missing

   Add an open question for anything the evidence cannot answer yet. It stays in the report, and in the case file, until someone resolves it.

3. 03

   Approve

   When the report is In review, open Review and history and select Approve report. Foxborne confirms with Report approved. Case files now carry your sign-off. The report then reads Approved in the drawer and beside the Report tab, and History and Activity gain the approval.

The status button in the incident header sets the incident to Open, In review or Closed. It changes the incident, not the report, which keeps its own state.

Check the result#

• The finding shows your name, the time and the level you chose.
• Every sequence line has an E number and an entry under 3 Evidence.
• Before you export shows no warning you cannot account for.
• History lists each edit.

Troubleshoot#

Save does nothing in Edit the finding. The Finding is empty and has turned red. Write it and save again. Add question behaves the same way with an empty Question.

The sequence reads No events in the sequence yet. Add events from the inspector with Add to report, or tick them in Edit the sequence.

There is no Approve report button. Only the incident's named reviewer sees it, and only while the report is In review.

The sources check is a warning. The sequence is empty, or a line's source file is not in the run.

Next#