Case runtime

The investigation
survives every handoff.

The case is not a PDF attachment or a giant archive. It is the live state of the investigation: what happened, what was tested, what was ruled out, what can be done now, and what should happen next.

ζ

Persistent case

Case passport
Illustrative structure
Incident stateAccelerator reset after thermal soak

Device, workload behavior, environment, and timeline preserved.

Current possibility setTwo mechanisms remain

Four alternatives ruled out with linked evidence.

Minimal reproducerApproved synthetic pattern

Operating preconditions and expected response included.

Current dispositionReturn with stated limits

Vendor-only telemetry named as the next settling test.

Experiment ledgerActions, parameters, controls, resultsExcluded causesEvidence and reasoning for each exclusionCustodyActor, time, release, receiving environment
Case state: Open · actionableDisclosure: ScopedIntegrity: Attested

What persists

The case remembers the reasoning, not just the files.

A receiving engineer can continue from the current frontier instead of reconstructing the incident from logs and prose.

Original incident state

The physical device, workload behavior, conditions, and timing that made the event real.

Live possibility set

What could still explain the event, what has been ruled out, and the evidence for both.

Experiment ledger

Every approved action, parameter, matched control, result, and decision in sequence.

Minimal reproducer

The smallest approved workload and operating conditions that carry the phenomenon.

Decision state

Current disposition, operating envelope, confidence, expiry conditions, and recurrence checks.

Next capability request

When certainty is incomplete, the exact protected test most likely to settle the decision.

Cross-organizational continuation

The same case can be re-instantiated under local control.

Each party contributes only the capability and result needed at that stage. The causal thread remains continuous.

  1. 01

    Operator case

    Incident context and local isolation remain intact.

  2. 02

    Portable capsule

    The reproducer, exclusions, schema, and requested capability travel.

  3. 03

    Vendor replay

    Protected tools run locally; only scoped outputs join the case.

  4. 04

    Supplier child case

    A narrower component question can fork without losing ancestry.

  5. 05

    Structured return

    The finding merges back into the parent case and the fleet action.

Scoped disclosure

The phenomenon travels. Proprietary environments do not.

Stays local

Raw production data

Customer workloads, broad telemetry, secrets, and unrestricted infrastructure access.

Travels with the case

The reproducible phenomenon

Synthetic reproducer, expected response, conditions, exclusions, and evidence references.

Stays local

Proprietary vendor capability

Internal tests, design data, registers, and implementation details remain protected.

Returns to the case

A scoped result

Signed finding, corrective action, confidence, limitations, and validation evidence.

Persistent, not static

The case changes state as evidence arrives.

It can fork for a supplier question, merge a signed result, expire an operating recommendation when conditions change, and reopen if the phenomenon returns.

OpenActionableIn replayClosedReopen on recurrence

Continue the investigation

Carry the investigation—not another attachment.

Explore a case format built to survive operator, vendor, and supplier boundaries.