Understand findings and citations

Interpret finding types, confidence, citations, unresolved leads, and next steps.

A finding is a statement supported by one or more recorded reads. Use its type, confidence, and citations together; none is sufficient alone.

Finding types

Type	Meaning
Probable cause	The condition most likely to have initiated the incident.
Triggering change	A deployment or edit that set the incident in motion.
Contributing factor	A condition that increased impact or allowed propagation.
Symptom	An observed effect, not an explanation.
Propagation effect	Downstream impact caused by the original failure.
Ruled-out explanation	A plausible cause that a relevant read excluded.
Unresolved lead	A plausible explanation that could not be verified, with the read needed to resolve it.

Confidence

• confirmed means the cited reads establish the finding.
• likely means the finding is supported, but a plausible alternative remains.
• possible means it is one open explanation among several.

Confidence is not impact or priority. A severe symptom can be confirmed while its cause remains possible.

Citations and reads

Each citation points to a read recorded during the investigation. The record includes the source, query scope, time window, outcome, references, and whether the result was truncated. Failed reads remain visible because unavailable data can explain why a lead stayed unresolved.

OpenCluster stores a summary and provenance for each read, not a permanent bulk copy of all returned content. A finding that cites a read that did not run is rejected rather than stored.

No established cause

A valid conclusion can contain only unresolved leads or no findings. Use the recorded reads to see what was checked, then connect the missing source or run the recommended operator check. Do not interpret an empty conclusion as proof that nothing happened.

Next steps

Next steps are suggested actions, ordered toward reversible checks and mitigations. They are not executed automatically and are not evidence for a finding.