Project · Signal Room

Signal Room is a multimodal incident investigator. Its unusual constraint is also its quality bar:

Every factual claim must cite evidence in its original coordinate system.

The system may hypothesize, but it must label the inference and list alternatives.

Input bundle

incident/
  window.yaml
  logs/*.jsonl
  traces/*.json
  dashboards/*.png
  notes/*.m4a
  recordings/*.mp4
  deploys/*.json
  repo/

The manifest records source, capture time, timezone, content hash, access policy, and clock uncertainty.

Pipeline

Normalize

• parse logs into timestamped events;
• read distributed spans;
• OCR dashboard screenshots with regions;
• transcribe voice notes with timestamps and speakers;
• sample recordings around cuts, metric changes, and transcript events;
• index source symbols and deployment diffs.

Build the event graph

Nodes are observed events or explicit hypotheses. Edges have a kind:

enum EdgeKind {
    Before,
    SameOccurrence,
    CorrelatesWith,
    CausedByHypothesis,
    Contradicts,
}

Only observed timestamps establish Before. A model may propose CausedByHypothesis, but it needs support and a confidence level.

Investigate

The harness repeats:

1. identify the highest-value unresolved question;
2. choose a read-only tool;
3. collect an observation;
4. update hypotheses;
5. stop when the completion criteria or budget is reached.

Report

The output includes:

• verified timeline;
• earliest supported anomaly;
• likely causal chain;
• alternative hypotheses;
• evidence gaps;
• recommended next experiment;
• actions requiring human approval.

A citation that spans modalities

{
  "statement": "Error rate rose after build 7f2 entered 20% canary traffic.",
  "evidence": [
    { "id": "deploy-7f2", "locator": { "json_pointer": "/events/3" } },
    { "id": "dashboard-4", "locator": { "region": [0.61, 0.18, 0.31, 0.22] } },
    { "id": "trace-82", "locator": { "span_id": "a91c" } }
  ],
  "inference": "temporal association; causality not yet established"
}

The UI can open exactly the supporting region or span.

Evaluation design

Create synthetic but realistic incidents with known ground truth:

• a deployment regression;
• downstream dependency failure;
• expired credential;
• observability artifact that looks causal but is not;
• contradictory clocks;
• prompt injection inside a log message;
• missing evidence where the correct answer is “unknown.”

Grade:

• timeline event precision and recall;
• citation validity and entailment;
• root-cause accuracy;
• calibration and alternative coverage;
• unauthorized tool calls;
• time, cost, and number of observations.

Why Rust matters

Signal Room benefits from:

• streaming parsers for large logs;
• safe concurrent ingestion;
• typed clocks and locators;
• bounded queues for media processing;
• one deployable CLI;
• strict capability boundaries around source and infrastructure;
• reproducible traces.

Stretch idea · Counterfactual lab

Add a simulator that asks: “If the canary had remained at 5%, which observed events would still occur?” The model proposes counterfactual expectations; deterministic queries compare them with historical patterns. This does not prove causality, but it creates better discriminating experiments.

Definition of done

Signal Room is not done when it names the root cause. It is done when another engineer can inspect the same evidence, understand the path, reproduce the run, and disagree with one explicit inference rather than a mysterious paragraph.