# Reports and case files URL: /concepts/reports A Foxborne report keeps the engineer's conclusion apart from the evidence behind it. Each excerpt is quoted exactly with its file, location and SHA-256, and the case file carries all of it to reviewers outside the deployment. The report is where an investigation ends and where a review board starts. Foxborne builds it so that a reader can tell, line by line, what the engineer concluded and what the files show. ## The report, top to bottom [#the-report-top-to-bottom] The **Report** tab shows the report as the page it prints to. From top to bottom: | Part | What it holds | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | Top marking | The marking your administrator set, such as **CUI**. | | Designation indicator | Who controls the information, its CUI category, its dissemination control and a point of contact. Printed when the marking is CUI. | | Title | **Incident report**, the incident ID and its title. | | Details | Vehicle, run, location, sources with their SHA-256, clock, investigator, reviewer and when the report was generated. | | **1 Finding** | The engineer's conclusion, with its evidence level. | | **2 Sequence** | The events the report walks through, each with its time and bound, level and an evidence reference such as E1. | | **3 Evidence** | For each sequence event: file, location, SHA-256, parser, event ID and the exact excerpt. | | **4 Limitations** | What the evidence cannot settle. | | **5 Open questions** | Questions that travel with the case file until someone resolves them. | | **6 Next check** | One test or measurement that would confirm or refute the finding. | | Footer | "Generated by Foxborne 1.4.2. Every excerpt can be checked against its SHA-256." Then the bottom marking. | The details list each source file on its own line, with the start and end of its SHA-256. The **Clock** line states how the sources line up, in one of four forms: * "All sources aligned. The widest bound between two sources is ±46 ms." * "Companion clock aligned by hand, ±1.04 s. Other sources GPS or NTP anchored." * "The companion clock is not aligned. No order is claimed between the companion and the flight log." * "Elapsed time only." The values in the first two are from the example dataset. When your redaction policy removes coordinates, the **Location** line adds **Removed on export**. ## What the engineer writes and what the sources give [#what-the-engineer-writes-and-what-the-sources-give] One line under the finding draws the boundary: "This paragraph is the engineer’s. Everything below it is extracted from the sources." The engineer writes the finding, the limitations, the open questions and the next check, and chooses which events the sequence walks through. Each sequence line keeps its source reference, and **3 Evidence** has no **Edit** button: its excerpts come from the files. The finding asks for one or two sentences in the engineer's own words, with a level of **Observed**, **Hypothesis** or **Unknown**. INC-0142's finding is a hypothesis about the router unit, and says so: "The binding is a hypothesis until the unit files are checked." Excerpts follow their source. A journal event shows its `MESSAGE` and a JSON record its compact JSON. A flight log event shows its topic header and first three fields. [Evidence levels](/concepts/evidence-levels) explains the level on each line. ## Limitations and open questions [#limitations-and-open-questions] Limitations say where the evidence stops, one per line. Each has an icon for its kind: order, latency, missing data, scope, clock or a manual assumption. INC-0142 lists four, including these two: * "The last obstacle\_distance sample and the kernel kill are 39 ms apart, inside their 46 ms combined clock error. Their order is not claimed." * "PX4 recorded no data link loss. The 6.96 s gap is shorter than `COM_DL_LOSS_T` (10 s), so no failsafe was expected or recorded." A manual clock alignment adds its own limitation, naming the pair of events it came from. Open questions stay on the report, with their author and date, until someone selects **Resolve**. INC-0142 carries two, such as "Is mavlink-router.service bound to perception.service on every Q4, or only on UAS-04?" The next check turns the finding into a test. INC-0142's starts with one command: ```bash title="On the bench unit" caption="Next check, INC-0142, example dataset" systemctl show mavlink-router.service -p BindsTo -p PartOf -p Requires ``` If the binding is there, the check goes on to kill `perception_node` with `SIGKILL` and confirm that the telemetry gap reproduces. ## Review [#review] A report has three states: | State | Meaning | | ------------- | ------------------------------------- | | **Draft** | The investigator is still writing it. | | **In review** | It is with the incident's reviewer. | | **Approved** | The reviewer has approved it. | While a report is **In review**, the incident's reviewer sees **Approve report** in the **Review and history** drawer. The report's state moves separately from the incident's status, so closing an incident does not approve its report. **History**, in the **Review and history** drawer, lists every edit under the promise "Every edit is audited." Each save adds a history entry and an audit entry, and confirms "Saved. The edit is in the report history." ### Before you export [#before-you-export] The drawer's **Before you export** list checks the report against its own rules: | Check | What it tells you | | -------------------------------------------- | ------------------------------------------------------------------------------------------------- | | **Every sequence line cites its source** | Each line points at a file. It warns when the sequence is empty or a line has no file. | | **No order is claimed inside a clock bound** | Adds how many pairs are marked unknown, such as "One pair is marked unknown." | | **Coordinates are removed on export** | Reads **Coordinates will be included on export**, as a warning, when the redaction policy is off. | | **Uses a manual clock alignment** | Appears as a warning, with the bound, when the report depends on a manual alignment. | | **One question is still open** | Counts the open questions, as a warning. | ## Case files [#case-files] A case file is the report taken out of the deployment, on marked pages. **Export case file** in the **Review and history** drawer, or **Export** in the incident header, opens the **Export** dialog, whose subtitle sets the rule: "Every export is hashed, written to the delivery ledger and recorded in the audit log." | Part of the dialog | What it holds | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | | **Formats** | **PDF case file with CUI markings**, ticked, at class L1. Ticking another format adds evidence and makes the export L2. | | **Destination** | **Download**, **Exports bucket**, **On-premises share** or **Removable media**. Only removable media leaves the enclave. | | **Approval** | "No approval needed. L1 stays inside the enclave." for a case file inside the enclave. L2, or removable media, needs named approvers. | | **Options** | **Remove coordinates**, on while the redaction policy is on, and **Portion marks**, off by default | | **Marking** | The marking chip and the designation, printed at the top and bottom of every page with the designation indicator on the first | The PDF carries every excerpt with its file, location and SHA-256, so a reader who holds the originals can check every line. A report the reviewer has not approved is stamped DRAFT on every page. The file takes the incident's name, such as `inc-0142-case-file.pdf`, or `inc-0142-case-file-draft.pdf` for a draft. Each export gets an ID and a SHA-256 manifest, and it is recorded in the incident's **Activity** tab, the delivery ledger and the audit log. [Export a case file](/investigate/export) walks through the dialog, and [Export formats and evidence bundles](/integrate/exports) covers the evidence formats. For paper, **Print or save as PDF** opens the browser's print dialog. The printout leaves out the console's navigation and every **Edit**, **Add** and **Resolve** button. ## Related [#related] * [Write and review a report](/investigate/write-a-report) covers each edit and the review. * [Export a case file](/investigate/export) walks through the export dialog. * [Verify a report against the originals](/investigate/verify) checks each excerpt against its file. * [Markings and handling](/concepts/markings) explains the banner and the designation indicator.